Anthropic says unreleased Claude model built working exploit chains in major software

Anthropic's Frontier Red Team published research showing an unreleased internal AI model found security flaws in Chrome, Safari, Android, Windows and Linux and chained them into working proof-of-concept exploits. The company said the attacks could achieve remote code execution and other serious impacts with little or no user interaction. It said the work required only "initial prompting" and "little human involvement."

The exploits were built in a lab after the model was prompted. They have not been seen in a real attack. Anthropic says it reported every flaw to the vendor first, and all are patched. It says it used coordinated vulnerability disclosure and pointed to its Cyber Verification Program, which helps defenders find and fix weaknesses before attackers exploit them.

Chrome and Safari

In Chrome, the model used four flaws in sequence: memory corruption in V8, a second flaw that escaped V8's memory sandbox, a race condition in CacheStorage, and a use-after-free in FedCM that ran code outside the sandbox. Anthropic's proof of concept launched the Calculator app on a Mac running default Chrome within seconds of a page loading, without further user interaction.

Anthropic says it reported 62 flaws to Google; they were assigned CVEs and fixed as of Chrome 156. All were rated critical or high, including 13 sandbox escapes and 21 flaws usable to compromise the renderer process. Google's release notes credit "Xinyang Ge of Anthropic, assisted by Claude" for specific Chrome fixes, though not for all 62.

The Safari chain did not run code. It obtained full read and write access to browser memory, then changed a single value to turn off the same-origin policy, which prevents one website from reading another's data. That could expose browsing history, cookies and authenticated sessions. Apple fixed the use-after-free at the center of the chain in iOS and iPadOS 26.5.2 and credits "Milad Nasr and Nicholas Carlini with Claude, Anthropic."

Android and Windows

On Android, the model combined weaknesses in open-source Android components and proprietary Google Play services, using code analysis, reverse engineering and tests on a Pixel 9. The chain could extract photos and other personal information from a locked phone over USB. Google has addressed the issue, according to Anthropic.

The Windows chain is a denial of service: a few network packets crash the machine, and repeating them keeps it down, but it does not run code or steal data. Anthropic describes the flaw as an out-of-bounds read in the Windows kernel's QUIC handling. Anthropic says Microsoft fixed the issue and assigned CVE-2026-33096. The public record for that CVE instead names HTTP.sys, Windows' built-in web request handler, and rates it 7.5 out of 10. No open source ties those two descriptions together as the same component. The CVE record credits no finder, so Anthropic's authorship of this one rests on its own post. As of late October, the U.S. government's vulnerability enrichment marked the flaw as not exploited, and it was not in the CISA catalog of known exploited bugs.

Linux root access

The Linux finding is the most serious in terms of impact: it runs commands as root over the network without a login. It needs the target server to be running a multipath TCP listener. MPTCP is opt-in: applications must explicitly request it when creating sockets, though eBPF and other configuration techniques can force applications to use it.

Anthropic ties the chain to CVE-2026-98432, a kernel use-after-free rated 9.8 and fixed upstream on October 15. The public record for that CVE describes an IPv4 TCP fix rather than a multipath TCP one, and the two are linked only by Anthropic's post. The flaw affects eight kernel branches dating back to version 4.4, with fixes in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7.

Anthropic says its proof of concept took 48 minutes to leak a kernel address and five more to reach a root shell, about 53 minutes in total. A failed attempt does not crash the system, the company said, so an attacker can keep retrying. Ubuntu and Red Hat Enterprise Linux had yet to release patched kernels as of October 30. Debian, Oracle Linux, SUSE and Amazon Linux had fixed kernel packages for at least some releases. Administrators should review kernel versions, apply updates and assess whether their systems expose MPTCP listeners.

Discovery versus patching

Anthropic argues frontier models can now discover and combine multiple vulnerabilities into a working exploit, work that used to belong to a few specialist teams. The harder part comes after. Researchers must verify findings, developers must prepare fixes, and administrators must deploy patches across potentially thousands of systems.

OpenAI said last month that its unreleased GPT-5.6-Cyber model had uncovered hundreds of vulnerabilities, including flaws in Chrome's V8 JavaScript engine, a mobile operating system, a database and an operating-system kernel. Security experts warn that AI could accelerate vulnerability discovery beyond the pace at which organizations can investigate and fix problems.

What a reader cannot check is how much of each chain the model built on its own. Anthropic does not break down what a person did at each step, and it does not name the model beyond calling it an unreleased, internal research model. The strongest claim is not any single bug, but that one model found several separate flaws and combined them into a working exploit. That claim rests on Anthropic's own account. The patches and the fact that Apple and Google credit Anthropic and its Claude model for specific fixes can be verified with the vendors.