Anthropic shows Claude-built exploit chains for Chrome, Safari, Android, Windows and Linux

Anthropic’s Frontier Red Team has published details of five attack chains that it says were written by “an unreleased, internal research model” after initial prompting. The targets were Chrome, Safari, Android, Windows and the Linux kernel. Anthropic does not name the model, and it is not something you can use.

Every bug in the post was reported under Anthropic’s disclosure policy, which gives vendors 90 days to patch plus 45 more days before Anthropic goes beyond the public advisory. Nothing in the post or the vendor notes says any of these bugs were used in attacks.

The five chains, as Anthropic describes them

• Chrome, one click to code execution outside the sandbox. A V8 heap corruption bug, a second bug to escape V8’s memory sandbox and defeat ASLR, a race condition in CacheStorage to read memory outside the renderer sandbox, and a use-after-free in FedCM, Chrome’s federated sign-in feature. Anthropic says its proof of concept opens Calculator on a default Chrome on macOS within seconds of loading the page.
• Safari, one click to read other sites’ data. A use-after-free in JavaScriptCore, a way out of WebKit’s Gigacage, and a flaw in the WebContent sandbox’s IPC. The chain then flips the same-origin policy off without ever running native code. Anthropic’s example: a page could read your email if you are signed in elsewhere.
• Android lock screen bypass. On a physical Pixel 9, three chained bugs let a USB host pull photos and other data from a locked phone. Anthropic says the issue “has been addressed by Google” but gives no CVE or bulletin.
• Windows remote crash. An out-of-bounds read reachable over HTTP/3 lets an attacker crash and reboot a server with a few packets. Anthropic estimates “likely several million” exposed servers.
• Linux, zero-click root. A race-induced use-after-free in the kernel networking stack gave a remote root shell on servers with a multipath TCP listener. In Anthropic’s proof of concept, leaking a kernel pointer took 48 minutes and reaching the shell another five.

Anthropic adds that it found local privilege escalations on OpenBSD, FreeBSD and Linux, sandbox escapes and web app bugs, without listing identifiers.

What the vendor records show

The Chrome 156 release notes from 20 October list 353 security fixes. Fifteen critical or high fixes are credited to Xinyang Ge, one of the post’s authors, and five of those read “Xinyang Ge (Anthropic), assisted by Claude”. Anthropic’s own figure is larger: 62 CVEs “assigned and patched as of Chrome 156”, all critical or high, including 13 sandbox escapes. We have not tallied earlier Chrome releases to reconcile the two counts.

Apple’s iOS and iPadOS 26.5.2 notes, released 29 June, credit WebKit CVE-2026-43715 to “Milad Nasr and Nicholas Carlini with Claude, Anthropic”. That is the page Anthropic links as the Safari fix.

Two details read differently in the public records:

• CVE-2026-33096 is listed by Microsoft and NVD as an out-of-bounds read in Windows HTTP.sys that allows network denial of service, published on 14 April 2026, so this is a disclosure of an older fix.
• CVE-2026-98432, which Anthropic gives for the Linux chain, is described in the kernel’s CVE text as a use-after-free in IPv4 TCP request-socket option handling, fixed by freeing the options after an RCU grace period. That text does not mention multipath TCP. Anthropic says the fix was backported to all maintained stable kernels.

What to do

• Make sure Chrome is on 156 or later and that iPhones and iPads are on 26.5.2 or later.
• Check that Windows servers answering HTTP/3 have the April 2026 updates or newer.
• Update Linux servers to a current stable kernel from your distribution, especially if they accept TCP from the internet.

Anthropic also recommends scanning code at pull-request time and points to its Claude Code security-guidance plugin. Its expanded Cyber Verification Program offers qualifying security professionals reduced blocking classifiers and access to Opus 5.5, Sonnet 5.5 and Mythos 5.1.

For Anthropic’s earlier open-source scanning work, see our post on its cyber mission scanner.