Anthropic says an unreleased internal Claude model identified and chained vulnerabilities across Google Chrome, Apple Safari, Android, Windows and the Linux kernel, producing five working exploit demonstrations. The company’s Frontier Red Team report, published Oct. 27, says the model required initial prompting but then performed much of the vulnerability research, reverse engineering and exploit development itself.
The most extensive result targeted a stock Chrome browser on macOS. Anthropic says the model chained a V8 heap-corruption bug, a V8 sandbox escape, a CacheStorage race condition and a use-after-free in Chrome’s Federated Credential Management feature to execute code outside the browser sandbox after a user loaded a malicious page. Google assigned 62 CVEs to the reported findings and patched them by Chrome 156; Anthropic says all were rated high or critical, including 13 sandbox escapes and 21 flaws capable of compromising the renderer. The report does not provide the individual CVE numbers or CVSS scores.
In Safari, the model reportedly built a one-click, data-only attack that bypassed WebKit’s same-origin policy, allowing a malicious site to access browser history, cookies and authenticated responses from other origins. Anthropic attributes the chain to a JavaScriptCore use-after-free, weaknesses involving WebKit’s Gigacage and a sandbox IPC flaw. Apple acknowledged the report the day it was submitted and made a fix available, but Anthropic did not identify a Safari version, CVE number or Apple advisory in its disclosure.
The other demonstrations broadened the defensive impact. On a physical Google Pixel 9, Claude combined Android and Google Play services weaknesses to bypass USB pairing and the lock-screen protections that normally prevent file transfer, extracting photos and other data without unlocking the phone; Google says the issue has been addressed. Anthropic also reported a remotely triggerable denial-of-service flaw in Windows’ kernel QUIC implementation. Microsoft assigned CVE-2026-33096 after Anthropic’s report; public vulnerability records describe it as an out-of-bounds read reachable through HTTP/3, with a reported CVSS score of 7.5.
The highest-consequence example involved Linux networking. Anthropic says its model developed a zero-click exploit against servers with a multipath TCP listener, using a race-condition use-after-free to leak kernel addresses and ultimately execute commands as root. The flaw is tracked as CVE-2026-98432; the Linux kernel’s CVE authority rates it 9.8, while Red Hat lists a preliminary 8.1 score. The upstream fix was backported to maintained stable kernel branches, and NVD records describe affected Linux branches including 5.10 before 5.10.272, 5.15 before 5.15.223 and 6.1 before 6.1.190.
For defenders, the immediate priority is to install current Chrome, Safari, Android, Windows and Linux updates, verify that distribution kernels include the CVE-2026-98432 backport, and review internet-facing HTTP/3 and multipath TCP services. Anthropic’s report does not claim that any of these chains were used in real-world attacks, and neither CVE appears in the CISA Known Exploited Vulnerabilities catalog based on the available records. The disclosures nevertheless show how an AI system can combine individually narrow bugs into practical attack paths spanning browser sandboxes, mobile authentication controls and kernel defenses.
