Anthropic's Claude Exploit Chains Hit Five Targets, Each With Limits

Anthropic's Frontier Red Team said on Oct. 27 that an unreleased internal Claude research model produced working exploit chains for Chrome, Safari, Android, Windows and Linux, and every one of the five has a limit that the headline number leaves out. The post says each exploit was produced "after initial prompting", that the vendors were told, and that it covers only vulnerabilities since resolved. It does not claim any of them was used against a real victim.

That distinction matters for how to read it: these are vulnerabilities and proofs of concept, and the post offers no evidence of exploitation in the wild. The claims rest on Anthropic's own account, and MediaNama wrote in its write-up that the model is unnamed, with no attempt counts, compute costs, false positives or failed targets disclosed.

What each of the five chains does, and where it stops

Target	What Anthropic built	Stated limit
Chrome on macOS, default config	One-click chain that launches Calculator outside the sandbox	Proof of concept; Google assigned 62 CVEs, fixed as of Chrome 156
Safari	One-click chain that bypasses the same-origin policy	Data-only; never reaches arbitrary code execution
Android on Pixel 9	Lock-screen bypass extracting photos and personal data over USB	Write-up is high-level; Google's fix described only generally
Windows	Remote crash and restart from a few packets, CVE-2026-33096	Denial of service, not code execution
Linux	Zero-click remote root, CVE-2026-98432	Needs a multipath TCP listener; race is retryable

The Chrome chain combined a V8 heap corruption bug, a memory-region sandbox escape, a CacheStorage race condition and a FedCM use-after-free. Of the 62 CVEs Google assigned, all rated critical or high, Anthropic says 13 are sandbox escapes and 21 are renderer-compromise bugs.

1. All CVEs assigned62 CVEs
2. Renderer compromise21 CVEs
3. Sandbox escape13 CVEs

Source: Anthropic Frontier Red Team post, Oct. 27, 2026, accessed 2026-11-02

The Safari chain used a JavaScriptCore use-after-free, a Gigacage bypass and an IPC sandbox weakness to expose history, cookies and authenticated sessions from other sites. Apple acknowledged the report the same day it was submitted and shipped a fix. Anthropic says some of the Safari weaknesses were intended behaviours that became exploitable only in combination, which is a different kind of finding from a coding error. Neither the Safari nor the Android chain has a CVE in the post.

The Windows bug was patched before the post

The Windows entry carries the biggest exposure figure in the post, which estimates that several million exposed servers could be affected. The flaw is an out-of-bounds read in the kernel's QUIC and HTTP/3 code that Microsoft tracks as CVE-2026-33096. Anthropic gave the model the binary and asked it to reverse-engineer it, and the finding surfaced when the model was asked for higher-risk issues.

A vulnerability database, cybersecurity-help.cz, lists the record as published on April 14, 2026, describing it as a boundary condition in the HTTP.sys driver when handling HTTP/3 requests. It gives fixed builds, among them 10.0.26100.32690 for Windows Server 2025 and 10.0.20348.5020 for Windows Server 2022, and says no public exploit is available.

That page does not give Microsoft's own release date, and it rates the flaw Medium while showing a CVSS v4 base score of 8.7. The vector (AV:N/AC:L/AT:N/PR:N/UI:N) explains the score: network reachable, no privileges, high impact on availability only. The score is accurate for a crash and says nothing about code execution, which the Anthropic post also does not claim.

The practical reading is that servers at or above the fixed builds in that list are past this bug. Anthropic's post does not say how many of its "several million" exposed servers remain unpatched.

The Linux chain has the most operational consequence

CVE-2026-98432 is the one with a live patching problem. Anthropic reported 48 minutes to leak a kernel pointer and about five more to reach command execution on servers with a multipath TCP listener. The race can be retried: a lost race fails the handshake without crashing the system. Our separate report tracks which distributions have shipped fixed kernels. Atlas Security says the exploit is not published, and that CISA has not added the CVE to its exploited-vulnerabilities catalog, which listed GitLab's CVE-2026-97229 on Oct. 29.

What Anthropic says defenders should do

The post names seven contributors: Nicholas Carlini, David Dworken, Xinyang Ge, Ben Morris, Milad Nasr, Chris Rohlf and Luna Tong. It gives no job titles. Atlas credits Ge with reporting the Linux flaw.

Anthropic's advice is that "scanning your own code is more important than ever." It says scanner diversity and more test-time compute raised the number of vulnerabilities found, and that scanning at pull-request time slows the rate at which new bugs enter a codebase. It released a Claude Code security-guidance plugin for that purpose. Three models, Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1, are available through an expanded Cyber Verification Program.

The disclosure terms are 90 days for vendors to patch, plus 45 days before details beyond the public advisory. The Linux fix landed upstream on Oct. 11, 16 days before the post, so the public record shows the patch preceding the write-up. Technical detail for the Chrome, Safari and Android chains has not been published.