Anthropic Says an Unreleased Claude Model Chained Bugs Into Working Exploits for Chrome, Safari, Android, Windows and Linux

Anthropic’s Frontier Red Team says an unreleased, internal research model spent the past few months finding and chaining vulnerabilities in five widely used products — Chrome, Safari, Android, Windows and the Linux kernel — into working proof-of-concept exploits, several with critical real-world impact. The company published the details on October 27, 2026, after responsibly disclosing each flaw to the affected vendor and waiting for patches to ship (Anthropic).

Five chains, five kinds of damage

Chrome. After an initial prompt, the model wrote a four-bug chain that runs code outside Chrome’s sandbox. The proof of concept launches the Calculator app on a stock, default-configuration Chrome install on macOS within seconds of a page loading, with no further clicks. The chain starts with a memory-corruption bug in V8 (Chrome’s JavaScript engine), escapes V8’s memory sandbox and defeats ASLR to hijack the renderer process, uses a race condition in CacheStorage to map the privileged browser process’s memory, and finishes with a use-after-free in FedCM, Chrome’s sign-in feature, to break out of the sandbox entirely. Anthropic says Google assigned and patched 62 CVEs tied to this work as of Chrome 156, all rated high or critical, including 13 sandbox escapes (Anthropic). Chrome’s October 20 release notes credit “Xinyang Ge (Anthropic), assisted by Claude” for specific fixes, though not for all 62 (The Hacker News).

Safari. This chain never runs code at all. It uses a use-after-free in JavaScriptCore to get read/write access to browser memory, gets around WebKit’s Gigacage memory-isolation defense, exploits a flaw in the sandbox’s IPC mechanism to read Safari’s on-disk history, cookies and session data, then flips a single in-memory flag to disable the same-origin policy. With that protection off, a malicious page can read a signed-in user’s email or bank balance. Apple acknowledged the report the same day and shipped a fix (Anthropic).

Android. Working against a physical Google Pixel 9, the model combined source review, reverse engineering of Play Services binaries and live testing to chain three bugs that bypass a locked phone’s USB data block, skip the device-pairing authorization check, and defeat the six-digit pairing-code verification, then use a fallback transfer path to pull photos and other files off the device. Google has fixed the issue, according to Anthropic (Anthropic).

Windows. The model reverse-engineered a Windows binary with Ghidra to find an out-of-bounds read in the kernel’s QUIC/HTTP-3 handling. A handful of network packets sent to any machine answering HTTP/3 requests crashes and restarts it, and repeating the packets keeps it down; Anthropic estimates several million internet-facing servers could be affected. Microsoft resolved the issue and assigned CVE-2026-33096. The public CVE record instead names the Windows HTTP.sys driver, rates the bug 7.5, dates the fix to April 2026, and credits no finder — a gap The Hacker News flagged as unverifiable from outside Anthropic’s account (The Hacker News).

Linux. The most severe chain gives a remote attacker a root shell on any server running a multipath TCP listener, with no login and no user action. It first exploits a race-condition use-after-free to leak a kernel pointer and defeat KASLR, then reuses the same bug to overwrite a callback pointer with attacker-staged code, ending in a root shell. A failed attempt only drops the handshake rather than crashing the machine, so an attacker can retry indefinitely; Anthropic’s proof of concept took 48 minutes to leak the pointer and five more to get a shell. The company ties this to CVE-2026-98432, patched upstream October 15 and backported to stable kernels. The public Tenable record for that CVE describes an IPv4 TCP use-after-free rather than a multipath TCP one — a discrepancy that, again, is bridged only by Anthropic’s own post (The Hacker News; Anthropic).

What Anthropic says it learned

Anthropic attributes the breadth of findings to running many scanning agents in parallel — mixing pure coverage scans, goal-based scans (“does this expose anything that could compromise customer data?”) and threat-model scans — then measuring each scanner by how many net-new vulnerabilities it contributes, plus automated variant analysis on every confirmed finding. The company argues that fixing an existing bug backlog is only half the job and recommends scanning at pull-request time; it has released a Claude Code plugin for that purpose and expanded its Cyber Verification Program, which gives vetted security professionals access to Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1 with reduced blocking classifiers (Anthropic).

The caveats worth keeping in view

The headline claim is not any single bug but that one model found several unrelated flaws and chained them into a working exploit — work Anthropic says has historically required specialist human teams. That capability claim rests entirely on Anthropic’s own account: it does not break down how much of each chain the model built unassisted versus with human steering beyond “initial prompting,” and it names the model only as an “unreleased, internal research model,” not by version. Independent reporting also notes that for the Windows and Linux bugs, the public CVE records describe a different underlying component (HTTP.sys instead of QUIC; an IPv4 TCP fix instead of multipath TCP) than Anthropic’s narrative, and that neither record credits a named finder — gaps a reader cannot close without Anthropic’s own data (The Hacker News). Cybersecurity News’ coverage of the same post reaches the same conclusion: the lab results are real and the patches have shipped, but the capability narrative is Anthropic’s to verify (Cybersecurity News).

Why it matters for operators

For teams running agents with shell, browser or binary-analysis access, the practical takeaway isn’t that frontier models can write exploits on command — the chains needed deliberate, multi-step security research prompting, not casual use. It’s that the discovery-to-disclosure pipeline Anthropic describes (parallel scanning agents, standardized verification, PR-time scanning) is now something defenders can run too. Anthropic’s own Claude Security product already shipped continuous monitoring and automatic fix tracking earlier this year, the same scan-and-fix loop this research scales up. The financial stakes of exactly this kind of disclosure are already visible elsewhere: Bank of America has said patching flaws Anthropic’s Mythos model found cost it “a couple hundred million plus”, a reminder that a model finding bugs faster than a vendor can fix them has a real bill attached. That same tension — discovery outrunning patch capacity — is why 406 AI researchers have called to airgap cyber-capable models by default rather than leave them generally available.

All five chains described here are already patched: Chrome 156, the relevant iOS/iPadOS and Android updates, and the named Windows and Linux CVEs. Confirming your fleet is current on those specific releases is the concrete action item this research actually supports.