Anthropic says an unreleased Claude research model found critical flaws in Chrome, Safari, Android, Windows and Linux, then chained them into five working exploits with "little to no user interaction." The Frontier Red Team post, dated October 27, 2026, is getting wide security press coverage this week, including from Dark Reading and The Hacker News.
The exploits were built in a lab. Anthropic says it reported each vulnerability to the affected vendor under its coordinated disclosure policy, which gives developers 90 days to patch and a further 45 days before Anthropic discusses details beyond a public advisory. Dark Reading reports that all affected vendors have addressed the vulnerabilities.
Google is raising the same disclosure point. Its new $250,000 Root-in-Cloud bounty tier came with a warning from its VRP lead against disclosing unpatched bugs without coordination as AI tools make them easier to find.
The five attack chains
Anthropic describes each chain as starting "after initial prompting." Here is what each one does, according to the post:
- Chrome, one-click remote code execution. A malicious page corrupted heap memory in V8, Chrome's JavaScript engine. A second bug broke out of V8's memory sandbox and defeated ASLR. A race condition in CacheStorage let the compromised renderer read memory outside its sandbox, and a use-after-free in FedCM, Chrome's federated sign-in feature, let the exploit run code outside the sandbox. The proof of concept opens the Calculator app on a stock Chrome browser on macOS within seconds of the page loading. Anthropic says 62 CVEs have been assigned and patched as of Chrome 156, all rated critical or high, including 13 sandbox escapes and 21 bugs that could have compromised the renderer.
- Safari, one-click same-origin bypass. A use-after-free in JavaScriptCore, a way past WebKit's Gigacage memory isolation, and a flaw in the WebContent sandbox's IPC mechanism let the exploit read Safari's stored history, cookies and session data. Claude then used the use-after-free to switch off the same-origin policy, so the attacker's page could send signed-in requests to other sites and read the responses. Anthropic calls it "a data-only attack that never relies on arbitrary code execution." Apple acknowledged the report the same day and the fix is available, the post says.
- Android lock screen bypass. On a physical Google Pixel 9, Claude chained three bugs to pull photos and other personal data off a locked phone over USB, skipping the device-to-device transfer authorization check and the six-digit code verification. Anthropic says Google has addressed it.
- Windows remote denial of service. An out-of-bounds read in the Windows kernel's QUIC implementation would have let an attacker crash any Windows machine that answers HTTP/3 requests with the native stack, and keep crashing it. Microsoft resolved the flaw and assigned CVE-2026-33096. Anthropic estimates "several million such servers" are listening on the internet.
- Linux, zero-click root. A race-condition use-after-free in the kernel networking stack let a remote attacker run commands as root on servers with a multipath TCP listener, with no credentials. A lost race only fails the handshake, so an attacker can retry. The proof of concept took 48 minutes to leak a kernel pointer and five more minutes to reach shell command execution. Anthropic says CVE-2026-98432 was patched upstream and backported to all maintained stable kernel branches.
What outside records confirm
The Hacker News checked the vendor side. It reports that Google's Chrome release notes credit "Xinyang Ge of Anthropic, assisted by Claude" for specific fixes, though not for all 62, and that Apple fixed the central Safari bug in iOS and iPadOS 26.5.2 with credit to "Milad Nasr and Nicholas Carlini with Claude, Anthropic." All three people are in the post's contributor list.
The outlet also flags gaps. The public record for CVE-2026-33096 names HTTP.sys, rates it 7.5 out of 10 and credits no finder. The record for CVE-2026-98432, rated 9.8, describes an IPv4 TCP fix rather than a multipath TCP one, and The Hacker News says only Anthropic's post links the two. It also notes that Anthropic does not break down what a person did at each step, and does not name the model beyond calling it an unreleased, internal research model. Andrew Bolster of Black Duck told Dark Reading that the report gives "no success rates, cost, or human-hours per chain," and that the Android chain needed a stolen phone and a USB cable while the Linux exploit needed an exposed multipath TCP listener.
How Anthropic says it found so many bugs
The post credits two lessons. First, "test-time compute scaling and scanner diversity" raised the number of bugs found. Anthropic built a platform that runs large numbers of scanning agents in parallel, scores each scanner by how many additional vulnerabilities it adds, and tracks coverage so the whole codebase gets processed. Scanner strategies range from per-function checks to goal-based and threat model-based questions. Claude also ran automated variant analysis on every confirmed finding, and all findings pass through a standard verification and risk rating pipeline.
Second, fixing the backlog is only half the job. Anthropic recommends scanning at pull request time and says it has publicly released a Claude Code plugin with security guidance for that.
Beyond the five chains, Anthropic says Claude found local privilege escalation bugs on OpenBSD, FreeBSD and Linux, sandbox escapes in popular sandboxing infrastructure, and "numerous vulnerabilities in important web applications."
Why it matters
The core claim is about chaining, not any single bug. Anthropic writes that combining multiple vulnerabilities into a working exploit has "historically been the domain of few specialist teams," and that models can now do it "with little human involvement, and then prove by producing a working exploit that anyone can run and verify."
For defenders, Anthropic points to its expanded Cyber Verification Program, which offers qualifying security professionals reduced blocking classifiers and access to Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1. Security vendors are already building on that access; SentinelOne said this week it will add Claude Mythos 5.1 to its Wayfinder service. Other labs are being measured on the same skills, as in Irregular's GLM-5.3 cyberattack tests. Anthropic's advice to defenders is short: "scanning your own code is more important than ever."
The practical step for readers is the same either way. Update Chrome, Safari and iOS, Android and Windows, and move Linux servers to a patched stable kernel, especially any that run a multipath TCP listener.
Sources
- Anthropic Frontier Red Team: Discovering and exploiting vulnerabilities in critical, real-world software with Claude
- Dark Reading: Claude Builds Exploits Across Major Browsers and OSes
- The Hacker News: Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
