Anthropic Shows Claude Building Exploit Chains in Chrome, Safari, Android, Windows and Linux

Anthropic has published the most detailed public look yet at what a frontier model can do offensively: five working exploit chains, written by Claude, against some of the most security-critical software in the world. In a research post on October 27, 2026, the company says an unreleased internal research model found the bugs and then chained them into exploits "with little to no user interaction" across Chrome, Safari, Android, Windows and Linux.

This is a vendor's own account, so read the numbers as Anthropic's claims. What makes it notable is that the post names concrete, checkable outcomes: 62 Chrome CVEs, a Windows CVE (CVE-2026-33096), and a Linux kernel fix that has already been merged upstream.

TL;DR: the five chains at a glance

Agents that act on your behalf need rules. Agentbeam stops the dangerous actions →

What did Anthropic actually say?

The post is organized as five case studies plus a section on lessons for defenders. Anthropic describes the model as "an unreleased, internal research model" and says it was used "over the past few months." Each vulnerability was reported to the vendor under what Anthropic calls its coordinated vulnerability disclosure policy: 90 days for the developer to patch, then a further 45 days before Anthropic discusses details beyond the public advisory.

In every case the company says it began with "initial prompting" and the model did the rest. That phrase matters. The research claim is not that a human expert guided each step, but that a model, pointed at a target, produced a proof of concept anyone can run and verify.

Chrome: a four-bug chain that launches Calculator

The Chrome chain is the headline. According to Anthropic, Claude:

1. Found a bug in V8, Chrome's JavaScript engine, letting a malicious page corrupt heap memory.
2. Found a second bug to break out of V8's memory region sandbox and defeat ASLR, then used a return-oriented programming chain to take over the renderer process.
3. Found a race condition in CacheStorage to read memory outside the sandbox and learn the layout of the privileged browser process.
4. Found a use-after-free in FedCM, Chrome's federated sign-in feature, to run arbitrary code outside the sandbox.

The proof of concept launches the Calculator app on a stock, default-configuration Chrome on macOS within seconds of a page loading. Anthropic says it reported the findings to Google and that 62 CVEs were assigned and patched as of Chrome 156, including 13 sandbox escapes and 21 bugs that could compromise the renderer.

For context, Google's own Project Zero recently compared a classic fuzzer with its BigSleep AI agent on V8 and found the two tied, with limited overlap; see our write-up on Fuzzilli vs BigSleep. Anthropic's result goes a step further, because it is about chaining bugs into a full exploit, not just finding crashes.

Safari: a data-only attack

The Safari chain is interesting because, per Anthropic, it "never relies on arbitrary code execution." Claude found a use-after-free in JavaScriptCore where certain TypedArray operations wrote through stale pointers. It then worked around WebKit's Gigacage, which isolates TypedArray data, by finding variables in that region used as indexes into other regions, which gave an arbitrary read and write primitive. A flaw in the WebContent sandbox's IPC mechanism let the exploit read stored history, cookies and session databases. Finally, the use-after-free overwrote a variable to disable the same-origin policy.

The practical consequence, in Anthropic's words, is that a signed-in email account or bank session would be readable from an attacker's page. Several weaknesses were not bugs alone but intended behaviors that became exploitable in combination, which is exactly the kind of reasoning that has historically needed a specialist. Apple acknowledged the report the same day it was submitted, Anthropic says, and a fix is available.

Android: bypassing a lock screen with three research methods

The Android work combined source analysis of open-source Android, reverse engineering and deobfuscation of Google Play services binaries, and live testing on a physical Pixel 9. Claude chained three vulnerabilities and, according to the post, defeated four layers of protection:

• A locked phone is designed not to transfer data over USB; a USB host with a specific setting bypassed that.
• The device-to-device transfer protocol rejects data commands from unauthorized peers; Claude found a way to skip the authorization check and start pairing.
• Pairing requires a six-digit code to be verified by the user; a flaw skipped that step as if the user had tapped Allow.
• USB transfers are not supposed to carry file contents, enforced by a hardcoded check; a fallback mechanism sent raw bytes and was not covered.

The result: photos and personal information extracted from a stolen phone without unlocking it. Google has addressed the issue.

Windows: a QUIC bug found by binary analysis

The Windows finding is the only one where the model had no source code. Anthropic gave Claude a copy of the Windows executable and asked it to reverse-engineer the software with existing tools such as Ghidra, write a fully annotated C program reproducing the relevant features, compare behavior against the binary, and then study the code for flaws.

Prompted to look for higher-risk issues, the model surfaced an out-of-bounds read in the Windows kernel's QUIC implementation. A few network packets sent to a listening server could crash and restart the machine, and repeating the packets keeps it down. Anthropic estimates there are likely several million internet-facing servers on the vulnerable path. Microsoft resolved it as CVE-2026-33096. It is a denial of service, not code execution, so keep the severity in perspective; the interesting part is that the bug was found from a binary alone.

Linux: zero-click root over multipath TCP

The most severe chain is on Linux. Anthropic says Claude wrote an exploit for a race-condition use-after-free in the kernel networking stack that lets a remote attacker run commands as root against servers with a multipath TCP listener, with no credentials or interaction.

It works in two stages. First the attacker defeats KASLR remotely by abusing the race so the kernel reads an attacker-controlled length field and sends back extra bytes, which may include a kernel pointer. Second, the same bug overflows a buffer and overwrites a callback pointer to a payload staged in kernel memory, chaining existing kernel functions into an attacker-chosen shell command.

Because a lost race only fails the handshake rather than crashing the system, an attacker can retry indefinitely. In Anthropic's proof of concept it takes 48 minutes to leak a kernel pointer and five more minutes to reach the shell command. The flaw is tracked as CVE-2026-98432, patched upstream and backported to all maintained stable kernel branches. The company adds that it also found local privilege escalation bugs in OpenBSD, FreeBSD and Linux, plus sandbox escapes and bugs in web applications.

What did Anthropic learn about finding bugs at scale?

The post's methodology section is arguably the most reusable part. Anthropic says two lessons stand out:

• Test-time compute and scanner diversity find more bugs. It built a platform running many scanning agents in parallel, measuring each scanner by how many additional vulnerabilities it contributes, and tracking coverage so the whole codebase gets processed. Strategies range from pure coverage ("is there a vulnerability in this function?") to goal-based ("does this app expose anything that could compromise customer data?") to threat-model-based.
• Fix the flow, not just the backlog. Clearing existing bugs solves half the problem; the rest is stopping new ones entering. Anthropic recommends scanning at pull-request time and says it built security guidance into its development process through a Claude Code plugin that it has released publicly.

All findings run through a standardized verification and risk-rating pipeline so teams can experiment with new scanners without lowering the quality bar. This echoes what other vendors are shipping: see how Cognition wired Claude Mythos into Devin Security for deep scans.

What is confirmed, and what is not?

The honest summary is that the mitigations are real and verifiable through vendor advisories, while the model's autonomy is Anthropic's characterization. The company also stresses that these targets were chosen as bellwethers: "any vulnerabilities in these products could affect billions of users."

Why this matters for everyone who runs software

Three takeaways stand out beyond the headline.

First, the cost of an exploit chain is falling. Chaining four or more bugs through multiple sandboxes used to be the work of a few specialist teams. Anthropic's point is that a model can now do it with little human involvement and then prove it with a runnable exploit. That shifts the economics toward attackers who can afford compute, and toward defenders who adopt the same tools first. Our explainer on zero-days in the AI era covers why the patch clock is shrinking.

Second, expect more disclosures and more patches. Anthropic's deputy CISO has said publicly that AI-found flaws will keep rising; we covered what he actually said and what the evidence supports in Clinton's 18-month warning. A cluster of browser, mobile and kernel updates in the coming weeks is likely.

Third, the policy debate is catching up. Hundreds of scientists recently urged labs to keep cyber-capable models airgapped; see the 406-scientist open letter. Anthropic's own answer is the opposite emphasis: get powerful models to defenders first through its expanded Cyber Verification Program, which offers reduced blocking classifiers to qualifying security professionals and includes Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1.

What to do now

For individuals:

1. Update Chrome to version 156 or later, and update Safari, macOS, iOS, Android and Windows as patches arrive.
2. If you lost a phone, treat it as compromised until Android security patches are installed; the lock screen bypass assumed physical access.
3. Turn on automatic updates for browsers and operating systems.

For engineering and security teams:

1. Patch Linux kernels to a version containing the upstream fix for CVE-2026-98432, or disable multipath TCP listeners you do not need.
2. If you serve HTTP/3 on Windows with the native stack, confirm the CVE-2026-33096 update is deployed.
3. Scan your own code, as Anthropic advises, with several scanner styles in parallel, and move scanning to pull-request time. Our October cyberattack tracker shows how quickly exploitation follows disclosure.
4. If you run AI coding agents against production code, put guardrails around what they can execute. AgentBeam, built by the explainx.ai team, stops AI agents before they take dangerous actions.

Responsible disclosure envelope with padlock for Claude exploit chains reported to vendors

Open questions

• Which model was it? Anthropic names released models only in the context of its Cyber Verification Program, not for these findings.
• How much human help? "Initial prompting" is not a full transcript. Independent researchers will want to see how much steering each chain needed.
• What will the other labs show? Cryptography and math results from AI labs are drawing similar scrutiny; see our claimed-versus-verified look at AI labs probing cryptography.
• What about the 45-day window? Full technical details may emerge after it closes, which is when independent verification becomes possible.

Security patch bandage on a cracked gear illustrating patching AI-found vulnerabilities

Bottom line

If Anthropic's account holds, the bar for offensive vulnerability research has dropped sharply, and the main protection for ordinary users is the same as ever: patch quickly. The vendor advisories are the thing to verify, and the CVE numbers give you a place to start.

Related reading

• Fuzzilli vs BigSleep: AI agents and fuzzers tie on V8 bugs
• Anthropic's deputy CISO on the next 18 months of vulnerabilities
• Devin Security with Claude Mythos deep scans
• 406 scientists urge airgapping cyber-capable AI models
• What is a zero-day? Exploits and why AI changes the clock
• October 2026 cyberattacks tracker
• Official: Anthropic research post, Chrome Releases blog, Microsoft Security Response Center

Details, CVE numbers and patch status are as reported by Anthropic on October 27, 2026 and may change as vendors publish advisories.