Anthropic Says an Unreleased Claude Model Built Five Working Exploit Chains

Anthropic's Frontier Red Team said on 27 October 2026 that an unreleased, internal Claude research model had discovered security flaws in five widely used pieces of software — Chrome, Safari, Android, Windows and Linux — and chained them into working proof-of-concept exploits, largely without human guidance. The team described the work in a post titled "Discovering and exploiting vulnerabilities in critical, real-world software with Claude," co-authored by Nicholas Carlini, David Dworken, Xinyang Ge, Ben Morris, Milad Nasr, Chris Rohlf and Luna Tong.

What the model built

According to Anthropic, the Chrome chain let a single page load, viewed on a stock machine, run code outside the browser's sandbox; the Safari chain broke the same-origin policy, the rule that stops one website from reading another site's data, without needing code execution at all. On Android, the model combined bugs in the device-transfer and USB-handling path to pull photos and other personal data off a locked phone over a USB connection. On Windows, it produced a denial-of-service bug it describes as affecting the kernel's QUIC (HTTP/3) implementation, assigned CVE-2026-33096; Anthropic writes that "we estimate that there are likely several million such servers listening on the internet." On Linux, it built a zero-click exploit for a race-condition use-after-free bug in the kernel's networking stack, tracked as CVE-2026-98432, that lets an unauthenticated attacker reach root.

How it was disclosed

Anthropic says all of the Chrome-related findings were reported to the vendor before publication: "62 CVEs have been assigned and patched as of Chrome 156," which The Hacker News dates to a 20 October 2026 release. The company followed what it calls coordinated disclosure, giving vendors "90 days to patch and a further 45 days before we discuss details." Anthropic frames the release as a defensive move: "Enabling defenders with powerful models is critical to giving them a headstart on patching systems before attackers do."

The gap in independent confirmation

How much of this can outside researchers check directly varies by chain. The Hacker News, reporting independently on the disclosure, found that the public record for CVE-2026-33096, the CVE Anthropic cites for the Windows bug, "instead names HTTP.sys, Windows' built-in web request handler," not the QUIC component Anthropic describes, and that "the CVE record credits no finder, so Anthropic's authorship of this one rests on its own post." That leaves the Windows chain, like several others in the report, not independently verifiable from public CVE records alone. The Chrome chain is the most checkable of the five, since Google's own advisories list the 62 patched CVEs that Anthropic cites.

The Linux chain draws separate scrutiny

CSO Online, reporting on 30 October 2026, describes the underlying flaw as a bug in how the kernel hands off IP options from a pending connection request to a newly created socket on systems running Multipath TCP, and says Anthropic's proof of concept "took approximately 53 minutes to progress from the initial memory leak to successful root-level command execution." CSO Online reports the bug carries a severity score of 9.8, affects kernel branches back to version 4.4, and that as of its publication date, major distributions including Ubuntu and Red Hat Enterprise Linux had not yet shipped a patched kernel.

Why this matters beyond one report

For students and researchers in security and systems programming, the specific chains matter less than what they are evidence of: a model not sold or released to the public already combining multiple low-level memory bugs into end-to-end attacks across browser engines, mobile OS permission layers and kernel networking code — tasks that have historically required specialist offensive-security teams working for weeks. Anthropic's own framing is that publishing this capability, alongside full disclosure to vendors, is meant to give defenders equivalent tools before attackers acquire them by other means.

That framing is Anthropic's own argument, not an independently adjudicated conclusion — the company is both the discloser of the vulnerabilities and the seller of the model capable of finding them. What is independently checkable right now is narrower: the 62 Chrome CVEs patched in Chrome 156, the CVE identifiers for the Windows and Linux bugs, and the fact that, per CSO Online, some major Linux distributions had not finished patching as of 30 October 2026. Developers maintaining software in any of the five affected categories should treat the patched CVE lists, not the narrative around them, as the actionable material: confirming kernel and browser versions against the cited advisories is the concrete step this report supports.