Anthropic says an unreleased, internal Claude research model built working attacks against Chrome, Safari, Android, Windows and Linux, and the company published the details on October 27, 2026. The Claude exploit chains are already patched, according to Anthropic’s Frontier Red Team write-up, so nobody needs to panic. The bigger shift is what it implies: an AI model can now string several small bugs into one real break-in, and the patch you installed last week may be the only thing standing in the way.
TL;DR: Anthropic’s Frontier Red Team says an unreleased Claude model chained software bugs into working attacks on Chrome, Safari, Android, Windows and Linux. Anthropic lists 62 Chrome CVEs, all patched as of Chrome 156, plus fixes for the rest. If your browser, phone and PC are up to date, you are covered for these specific bugs. The lesson is that patch delays now cost more.
What the Claude exploit chains actually did
Anthropic describes the work as testing how well a model can find and exploit flaws in critical software. It says it used “an unreleased, internal research model” over the past few months, and it does not name the model.
The results cover five targets, and each one is a chain rather than a single bug. That distinction matters because a lone flaw is often harmless, while three or four linked together can hand over a device.
| Target | What Anthropic says Claude achieved | Status per Anthropic |
|---|---|---|
| Chrome | One-click chain ending in code execution outside the sandbox | 62 CVEs patched as of Chrome 156 |
| Safari | Website JavaScript bypassing the same-origin policy | Fix available; Apple acknowledged the report the same day |
| Android | Lock screen bypass on a Pixel 9 | Addressed by Google |
| Windows | Out-of-bounds read in the Windows kernel’s QUIC code, reached over HTTP/3 (CVE-2026-33096) | Resolved by Microsoft |
| Linux | Zero-click remote root on servers with a multipath TCP listener (CVE-2026-98432) | Patched upstream and backported |
The table is Anthropic’s own account, so the severity claims are as strong as the company’s testing, not independently audited. That is worth keeping in mind before treating any one row as settled.
Chrome and Safari: the browser side
Anthropic says Claude chained four Chrome bugs, ending with a use-after-free that gave code execution outside the browser sandbox. The proof of concept opened Calculator on stock Chrome on macOS within seconds of the page loading.
Anthropic puts the Chrome tally at 62 CVEs, all rated critical or high, and says they are patched as of Chrome 156. Our Chrome update tracker shows which version is current.
Safari was a different kind of attack. Anthropic says the chain let any website’s JavaScript completely bypass the same-origin policy, the rule that keeps one site from reading another. It adds that Apple acknowledged the report the same day and that a fix is available to users.
That Safari result is the quiet one. Nothing crashes, nothing pops up, and you would never know a page was reading your session data.
Android, Windows and Linux: the rest of the stack
The Android finding is the one that applies to a stolen phone. Anthropic says Claude pulled photos and personal information from a locked Pixel 9 by finding a way to skip the authorization check and start pairing, on a phone designed not to transfer data over USB when locked. Anthropic says Google addressed the issue, though it lists no CVE.
On Windows, Anthropic targeted any machine answering HTTP/3 requests through the native implementation, using an out-of-bounds read in the kernel’s QUIC code. Microsoft resolved it and assigned CVE-2026-33096. It estimates “likely several million such servers listening on the internet,” which is why a small bug earns a big number.
Linux was the most severe. Anthropic says the zero-click chain gave a remote attacker root on servers with a multipath TCP listener, and that its proof of concept needed 48 minutes to leak a kernel pointer. Anthropic adds that a determined attacker can retry indefinitely until the race succeeds.
Not a dramatic change for most people today, but a clear signal about how short the gap between a bug and a working exploit is getting.
What to check on your own devices
Because Anthropic says each bug is fixed, the practical step is simple. Open Chrome’s About page and confirm you are on version 156 or later, then restart the browser if it asks.
On iPhone, install the latest update; our iOS update tracker lists the current release. On Android and Windows, run the latest system and security updates, and on a Linux server, apply the current kernel patches.
Anthropic also notes that vendors get 90 days to patch, plus a further 45 days before Anthropic discusses details beyond the public advisory. Details on some of these bugs may still be thin for a while.
Why patch speed matters more now
For developers, Anthropic recommends scanning code at PR time. For everyone else, the takeaway is blunter: turn on automatic updates and stop dismissing the restart prompt.
The bugs here are fixed. The next batch will be found by someone, and the only variable you control is how fast your devices install the fix.
