Anthropic's unreleased research model found critical flaws in Chrome, Safari, Android, Windows and Linux, then chained them into five working exploits. The company published the work on October 27, and every vulnerability has since been patched by its vendor.[1][2]

The post comes from Anthropic's frontier red team and reads as a capability test: how far a frontier model can travel from a prompt to a runnable proof of concept that anyone can check. Each finding went to the affected vendor under coordinated disclosure, with 90 days to patch and another 45 before Anthropic discusses details beyond the public advisory.[1][3]

Five targets, five chains

The write-up walks through each chain with enough detail to follow the reasoning. The targets were not random. Browsers and operating systems sit under billions of users, and Anthropic calls them a bellwether for measuring a model's vulnerability research and cyber capability.[1]

• Chrome on macOS: code execution outside the browser sandbox after a single page load.
• Safari: a full bypass of the same-origin policy, exposing cookies, history and signed-in sessions.
• Android: lock screen bypass that pulls photos and personal data from a stolen Pixel 9.
• Windows: remote denial of service against machines answering HTTP/3 requests.
• Linux: zero-click remote code execution as root over multipath TCP.

Two of the five carry public CVE identifiers. Microsoft resolved the Windows bug as CVE-2026-33096, which NVD records as an out-of-bounds read in HTTP.sys with a 7.5 high severity score for network denial of service.[1][4] The Linux kernel flaw is tracked as CVE-2026-98432 and has been patched upstream and backported to maintained stable branches.[1]

Chrome: four bugs between a page load and Calculator

The Chrome chain is the most detailed. The model found a V8 vulnerability that let a malicious page corrupt heap memory, then a second bug that broke out of V8's memory region sandbox and defeated address space layout randomization. A return-oriented programming chain handed it control of the renderer process.[1]

Leaving the sandbox took two more findings. A race condition in CacheStorage let the compromised renderer read memory beyond its sandbox and map the privileged browser process. A use-after-free in FedCM, Chrome's federated sign-in feature, then delivered arbitrary code execution outside the sandbox.[1]

The proof of concept launches Calculator from a stock, default-configuration Chrome on macOS within seconds of a page loading, without a click. Google assigned 62 CVEs, all critical or high, and patched them as of Chrome 156. Thirteen were sandbox escapes and 21 could have compromised the renderer.[1]

Safari and Android: attacks that skip code execution

Safari's chain is unusual because it never runs attacker code. The model found a use-after-free in JavaScriptCore where TypedArray operations wrote through stale pointers. It then escaped WebKit's Gigacage by finding variables inside that isolated region used to index into others, which yielded an arbitrary read and write primitive.[1]

A weakness in the WebContent sandbox's IPC mechanism exposed Safari's stored history, cookies and session databases on disk. The same use-after-free overwrote a variable that controls the same-origin policy, so a hostile page could read responses from any site where the user had signed in, including email and banking sessions. Apple acknowledged the report the day it arrived and shipped a fix.[1][3]

Android needed several methods at once: source analysis of the open-source components, reverse engineering and deobfuscation of Google Play services binaries, and live testing on a physical Pixel 9. Three chained flaws defeated four separate controls. A USB host setting got past the rule against data transfer on a locked phone, a skipped authorization check started pairing, a flaw bypassed the six-digit code confirmation, and a fallback path carried raw file bytes past a hardcoded check. Google has addressed the issue.[1][3]

Windows and Linux: from a binary to a root shell

Windows is the only target where the model had no source code. Anthropic gave it the executable and asked it to reverse engineer the software with tools such as Ghidra, write an annotated C program that reproduced the relevant behavior, compare that program against the binary, and then study the result for weaknesses.[1]

Asked to look for higher-risk issues, the model surfaced the out-of-bounds read in the Windows HTTP/3 stack. A few packets sent to a listening server crash and restart the machine, and repeating them keeps it down. Anthropic estimates several million internet-facing servers sit on that path.[1][4]

The Linux chain is the most severe. A race condition in the kernel networking stack creates a use-after-free that lets a remote attacker run commands as root on servers with a multipath TCP listener, with no credentials and no interaction. The exploit defeats KASLR first by making the kernel return more bytes than it should, then overflows a buffer to overwrite a callback pointer with an address staged in kernel memory through an ordinary protocol feature.[1]

A lost race only fails the handshake instead of crashing the kernel, so an attacker can retry until it lands. In Anthropic's proof of concept, leaking a kernel pointer took 48 minutes and reaching shell command execution took five more.[1][3]

What engineering teams can copy

Anthropic's methodology section is the most reusable part. The team built a platform that runs many scanning agents in parallel, scores each scanner by how many new vulnerabilities it contributes, and tracks coverage so the whole codebase gets processed. Prompts range from plain coverage questions to goal-based and threat-model-based framing.[1]

The second lesson concerns flow, not backlog. Clearing existing bugs solves half the problem, and the other half is slowing how fast new ones arrive. Anthropic recommends scanning at pull request time and released a Claude Code plugin that adds security guidance during development.[1]

For defenders, the company points to its expanded Cyber Verification Program, which gives qualifying security professionals access to its most capable models with reduced blocking classifiers. The advice to everyone else is blunt: scan your own code.[1]

What is confirmed, and what is not

This is a vendor describing its own model, and the model is not named or available for outside testing. The mitigation side is checkable. Two CVEs exist, NVD lists the Microsoft score, the Linux fix is upstream, and Apple and Google both shipped patches.[1][4]

The autonomy claim has not been independently reproduced. Anthropic says each chain started with "initial prompting," which is not the same as a full transcript showing how much steering each step needed. Independent researchers will get a clearer view when the 45-day window on details beyond the public advisories closes.[1][3]

The operational advice survives that uncertainty. Chrome 156 or later carries the 62 fixes, Windows machines need the CVE-2026-33096 update, and Linux servers should run a kernel with the CVE-2026-98432 patch or drop multipath TCP listeners they do not need. Chains that once required a specialist team now come out of a prompt, and the patch clock has not slowed to match.[1][3]

Sources

1. Anthropic, "Discovering and exploiting vulnerabilities in critical, real-world software with Claude," October 27, 2026
2. The Hacker News, "Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits," October 28, 2026
3. explainx.ai, "Claude Exploit Chains: 62 Chrome CVEs, 5 Attack Chains," October 2026
4. NIST National Vulnerability Database, "CVE-2026-33096 Detail"