An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report.
The exploits were built in the lab after the model was prompted, not seen in any real attack, and Anthropic reported every flaw to the vendor first, so all of them are already patched. One proof of concept opened the Calculator app on a stock Mac running Chrome within seconds of a page loading, with no further clicks.
Anthropic’s Frontier Red Team described five chains in a research post. The strongest claim is not any single bug, but that one model found several separate flaws and combined them into a working exploit, something the company says has until now been the work of a few specialist teams. That capability claim rests on Anthropic’s own account.
The patches and the fact that Apple and Google credit Anthropic and its Claude model for specific fixes can be verified with the vendors.
What a reader cannot check is how much of each chain the model built on its own. Anthropic says the work needed only “initial prompting” and “little human involvement,” but it does not break down what a person did at each step, and it does not name the model beyond calling it an unreleased, internal research model.
For the one flaw with its own public record, the Windows bug, the record names no finder at all. Here are the five chains, what each would do, the condition each needs, and where the fix landed.
| Platform | What the exploit does | Condition it needs | Fix |
|---|---|---|---|
| Chrome | Runs code on the computer, outside the browser’s sandbox, from one visit to a web page | One click or page load, stock Chrome on macOS | Chrome 156, October 20 |
| Safari | Lets any website read data from other sites the user is signed in to, such as email or a bank account | One visit to a malicious page | iOS and iPadOS 26.5.2, June 29 |
| Android | Copies photos and other data off a locked, stolen phone | Physical access to the phone, over USB | Anthropic says Google has fixed it; no public record was found |
| Windows | Crashes a server over the network, and keeps it down by repeating | The server answers HTTP/3 requests | CVE-2026-33096, patched April 2026 |
| Linux | Runs commands as root over the network, with no login and no user action | The server runs a multipath TCP listener | CVE-2026-98432, patched October 15 |
In the Chrome chain, the model used four separate flaws in turn. A malicious page first corrupted memory in V8, Chrome’s JavaScript engine.
A second flaw escaped V8’s memory sandbox and took control of the part of Chrome that renders the page. A race condition in a feature called CacheStorage then let that code read memory it should not reach and learn the layout of the more privileged browser process.
A final use-after-free bug in FedCM, Chrome’s sign-in feature, let the exploit run code outside the sandbox entirely. Anthropic says it reported 62 flaws to Google that were assigned CVEs and fixed as of Chrome 156, all rated critical or high, including 13 sandbox escapes.
Google’s own release notes credit “Xinyang Ge of Anthropic, assisted by Claude” for specific Chrome fixes, though not for all 62.
The Safari chain is different because it never runs code at all. It chains flaws to obtain full read and write access to the browser’s memory, then changes a single value to turn off the same-origin policy, the rule that prevents one website from reading another’s data.
With that rule off, a malicious page can read a user’s history and cookies and send signed-in requests to other sites. Apple fixed the use-after-free at the center of the chain in iOS and iPadOS 26.5.2 and credits “Milad Nasr and Nicholas Carlini with Claude, Anthropic” for it.
The Windows chain is the one with an independent paper trail, and it is also the narrowest. It is a denial-of-service attack: a few network packets crash the machine, and repeating them keeps it down, but it does not run code or steal data. Anthropic describes the flaw as an out-of-bounds read in the Windows kernel’s QUIC handling.
The public record for the bug it points to, CVE-2026-33096, instead names HTTP.sys, Windows’ built-in web request handler, and rates it 7.5 out of 10. No open source ties those two descriptions together as the same component. The CVE record credits no finder, so Anthropic’s authorship of this one rests on its own post.
As of late October, the U.S. government’s vulnerability enrichment marked the flaw as not exploited, and it was not in the CISA catalog of known exploited bugs.
The Linux chain is the most serious in terms of impact: it runs commands as root over the network without a login. It needs the target server to be running a multipath TCP listener. The model first leaks a kernel memory address to bypass a defense called KASLR, then reuses the same race-condition bug to redirect the program to code the attacker has already placed, resulting in a root shell.
Anthropic says its proof of concept took 48 minutes to leak the address and five more to reach the shell, and that a failed attempt does not crash the system, so an attacker can keep retrying.
The company ties this chain to CVE-2026-98432, a kernel use-after-free rated 9.8 and fixed upstream on October 15; the public record for that CVE describes an IPv4 TCP fix rather than a multipath TCP one, and the two are linked only by Anthropic’s post.
Anthropic frames the work as help for defenders. It says it reported each flaw under a coordinated disclosure policy that gives developers 90 days to patch and 45 more before it discusses details beyond a public advisory, and it points security teams to its expanded Cyber Verification Program, which gives vetted professionals access to Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1.
The reason the company gives for publishing is in its own words: “Now, it’s something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify.”
