# Anthropic Says an Unreleased Claude Model Built Five Working Exploit Chains URL: https://edufabtech.com/news/anthropic-unreleased-claude-model-exploit-chains-chrome-safari-linux Section: News · Artificial Intelligence Published: 2026-10-31 Publisher: EduFabTech (https://edufabtech.com) > Anthropic's Frontier Red Team says an unreleased Claude research model autonomously chained vulnerabilities into five working exploit chains, reporting every flaw before publishing on 27 October 2026. Anthropic's Frontier Red Team said on 27 October 2026 that an unreleased, internal Claude research model had discovered security flaws in five widely used pieces of software — Chrome, Safari, Android, Windows and Linux — and chained them into working proof-of-concept exploits, largely without human guidance. The team described the work in a post titled "Discovering and exploiting vulnerabilities in critical, real-world software with Claude," co-authored by Nicholas Carlini, David Dworken, Xinyang Ge, Ben Morris, Milad Nasr, Chris Rohlf and Luna Tong. ## What the model built According to Anthropic, the Chrome chain let a single page load, viewed on a stock machine, run code outside the browser's sandbox; the Safari chain broke the same-origin policy, the rule that stops one website from reading another site's data, without needing code execution at all. On Android, the model combined bugs in the device-transfer and USB-handling path to pull photos and other personal data off a locked phone over a USB connection. On Windows, it produced a denial-of-service bug it describes as affecting the kernel's QUIC (HTTP/3) implementation, assigned **CVE-2026-33096**; Anthropic writes that "we estimate that there are likely several million such servers listening on the internet." On Linux, it built a zero-click exploit for a race-condition use-after-free bug in the kernel's networking stack, tracked as **CVE-2026-98432**, that lets an unauthenticated attacker reach root. ![A four-step timeline shows how the exploit chains moved from unguided discovery through a 90-day vendor patch window and 45-day embargo to publication, ending with 62 Chrome CVEs patched in Chrome 156.](https://edufabtech.com/uploads/2026/10/anthropic-unreleased-claude-model-exploit-chains-chrome-safari-linux-2.png) *A four-step timeline shows how the exploit chains moved from unguided discovery through a 90-day vendor patch window and 45-day embargo to publication, ending with 62 Chrome CVEs patched in Chrome 156. — EduFabTech · Own work* ## How it was disclosed Anthropic says all of the Chrome-related findings were reported to the vendor before publication: "62 CVEs have been assigned and patched as of Chrome 156," which The Hacker News dates to a 20 October 2026 release. The company followed what it calls coordinated disclosure, giving vendors "90 days to patch and a further 45 days before we discuss details." Anthropic frames the release as a defensive move: "Enabling defenders with powerful models is critical to giving them a headstart on patching systems before attackers do." ## The gap in independent confirmation How much of this can outside researchers check directly varies by chain. The Hacker News, reporting independently on the disclosure, found that the public record for CVE-2026-33096, the CVE Anthropic cites for the Windows bug, "instead names HTTP.sys, Windows' built-in web request handler," not the QUIC component Anthropic describes, and that "the CVE record credits no finder, so Anthropic's authorship of this one rests on its own post." That leaves the Windows chain, like several others in the report, not independently verifiable from public CVE records alone. The Chrome chain is the most checkable of the five, since Google's own advisories list the 62 patched CVEs that Anthropic cites. ## The Linux chain draws separate scrutiny CSO Online, reporting on 30 October 2026, describes the underlying flaw as a bug in how the kernel hands off IP options from a pending connection request to a newly created socket on systems running Multipath TCP, and says Anthropic's proof of concept "took approximately 53 minutes to progress from the initial memory leak to successful root-level command execution." CSO Online reports the bug carries a severity score of 9.8, affects kernel branches back to version 4.4, and that as of its publication date, major distributions including Ubuntu and Red Hat Enterprise Linux had not yet shipped a patched kernel. ## Why this matters beyond one report For students and researchers in security and systems programming, the specific chains matter less than what they are evidence of: a model not sold or released to the public already combining multiple low-level memory bugs into end-to-end attacks across browser engines, mobile OS permission layers and kernel networking code — tasks that have historically required specialist offensive-security teams working for weeks. Anthropic's own framing is that publishing this capability, alongside full disclosure to vendors, is meant to give defenders equivalent tools before attackers acquire them by other means. ![A side-by-side comparison contrasts Anthropic's account of the Windows exploit (a kernel QUIC bug, CVE-2026-33096) with the public CVE record, which names HTTP.sys instead and credits no finder.](https://edufabtech.com/uploads/2026/10/anthropic-unreleased-claude-model-exploit-chains-chrome-safari-linux-3.png) *A side-by-side comparison contrasts Anthropic's account of the Windows exploit (a kernel QUIC bug, CVE-2026-33096) with the public CVE record, which names HTTP.sys instead and credits no finder. — EduFabTech · Own work* That framing is Anthropic's own argument, not an independently adjudicated conclusion — the company is both the discloser of the vulnerabilities and the seller of the model capable of finding them. What is independently checkable right now is narrower: the 62 Chrome CVEs patched in Chrome 156, the CVE identifiers for the Windows and Linux bugs, and the fact that, per CSO Online, some major Linux distributions had not finished patching as of 30 October 2026. Developers maintaining software in any of the five affected categories should treat the patched CVE lists, not the narrative around them, as the actionable material: confirming kernel and browser versions against the cited advisories is the concrete step this report supports. ## Sources 1. Frontier Red Team (N. Carlini, D. Dworken, X. Ge, B. Morris, M. Nasr, C. Rohlf, L. Tong). (2026). Discovering and exploiting vulnerabilities in critical, real-world software with Claude. Anthropic https://www.anthropic.com/research/discovering-vulnerabilities-with-claude 2. The Hacker News. (2026). Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits. The Hacker News https://thehackernews.com/2026/10/anthropics-unreleased-ai-model-chains.html 3. CSO Online. (2026). Anthropic AI model finds Linux kernel bug that leads to remote root access. CSO Online https://csoonline.com/article/4242724/anthropic-ai-model-finds-linux-kernel-bug-that-leads-to-remote-root-access.html --- Source page: https://edufabtech.com/news/anthropic-unreleased-claude-model-exploit-chains-chrome-safari-linux Quote with a link to the source page. © EduFabTech.