Anthropic says Claude found exploit chains in Chrome, Safari, Android, Windows and Linux

What Anthropic reported

Anthropic's Frontier Red Team published on 27 October 2026 a report on using an unreleased internal research model to find vulnerabilities in widely used software and chain them into working exploits. The post covers five attack chains that led to remote code execution or other serious impact with little or no user interaction. Each issue was reported to the vendor under Anthropic's coordinated vulnerability disclosure policy, which gives vendors 90 days to patch plus 45 more days before details beyond public advisories are discussed.

In Chrome, the model chained a V8 heap corruption, a V8 sandbox escape with an ASLR bypass, a CacheStorage race condition and a FedCM use-after-free. The proof of concept launched Calculator from stock Chrome on macOS within seconds of page load. Google assigned 62 CVEs, all rated critical or high, including 13 sandbox escapes and 21 renderer-compromise bugs, fixed in Chrome 156. In Safari, a chain of a JavaScriptCore use-after-free, a Gigacage weakness and an IPC sandbox flaw bypassed the same-origin policy and exposed history, cookies and session data; Apple acknowledged the report the same day and shipped a fix.

The Android, Windows and Linux findings

On Android, the model extracted photos and personal data from a locked Google Pixel 9 by chaining three flaws, combining source analysis, reverse engineering of Google Play services and live testing; Google addressed the issue. On Windows, an out-of-bounds read in the kernel's QUIC/HTTP/3 implementation could crash a machine with a few packets and keep it down with repeated packets. Microsoft fixed it as CVE-2026-33096. Anthropic estimates several million servers may be listening on the internet; that figure is Anthropic's own.

On Linux, a race-condition use-after-free in the multipath TCP networking stack let a remote attacker defeat KASLR and run commands as root with no credentials. The proof of concept took 48 minutes to leak a kernel pointer and about five more minutes to reach shell execution. The issue is CVE-2026-98432, patched upstream and backported to maintained stable branches. Anthropic also reports local privilege escalations in OpenBSD, FreeBSD and Linux, sandbox escapes and web application vulnerabilities, without further detail.

What Anthropic says it means

Anthropic says frontier models can now find and chain vulnerabilities into working exploits with little human involvement, a skill it says was previously limited to specialist teams. It credits test-time compute scaling and scanner diversity: many parallel scanning agents, each measured by its unique contributions, with automated variant analysis on each confirmed finding. The company argues that defenders need equally capable models to patch before attackers do, and it points to an expanded Cyber Verification Program that gives qualifying security professionals advanced cyber capabilities and reduced blocking classifiers on Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1. It also released a Claude Code security guidance plugin for scanning at pull request time.

The post does not name the internal model, and it gives no cost, token usage or total time to discovery across the five chains. Several results are described as produced after initial prompting, and the amount of human guidance is not quantified. The Chrome and Linux exploits are working proofs of concept under specific conditions, and the post does not discuss real-world exploitation. Google DeepMind is not involved; the Chrome and Android fixes came from Google's product security teams.

What to watch next

The next signals are the public advisories for the Safari and Android issues, which have no CVE numbers in the post, and whether other labs publish comparable end-to-end exploit results. The 90-plus-45-day disclosure window means technical write-ups of these chains should appear from early 2027. More stories on AI and security are collected under Cybersecurity.

Questions people ask

Which CVEs did Anthropic's research produce?

Google assigned 62 CVEs fixed in Chrome 156. Microsoft fixed the Windows kernel issue as CVE-2026-33096, and the Linux multipath TCP bug is CVE-2026-98432. Safari and Android fixes have no CVE numbers in the post.

Which Claude model found the vulnerabilities?

Anthropic says an unreleased internal research model did the work and does not name it. The Cyber Verification Program offers Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1 to vetted professionals.

Were these exploits used against real users?

The post describes working proofs of concept reported to vendors under coordinated disclosure. It does not discuss any real-world exploitation.

Sources

1. Discovering and exploiting vulnerabilities in critical, real-world software with Claude (Anthropic (Frontier Red Team), 27 Oct 2026)