Unreleased Anthropic AI chains bugs in Chrome, Safari, Windows and Linux

What it's about

On October 27, 2026, Anthropic published a report from its Frontier Red Team, the team that tests the risks of the company's own frontier models. It says an internal research model, unreleased and not named, spent several months in test environments finding critical vulnerabilities in Chrome, Safari, Android, Windows and Linux, and chaining them into working attacks. The authors include Nicholas Carlini, David Dworken, Xinyang Ge, Ben Morris, Milad Nasr, Chris Rohlf and Luna Tong.

Important: all the flaws were reported to vendors in advance and, according to Anthropic, have been fixed. According to The Hacker News (cited in one of the sources), they were not observed in real-world attacks. An "exploit" is code that takes advantage of a security hole. "Chaining" means combining several small bugs so that together they do far more damage than any would alone.

The five attack chains

Chrome: The model wrote a chain that executed code outside the sandbox on a regular Chrome on macOS just by loading a web page. The sandbox is the isolated environment that separates browser content from the rest of the machine. In the demo, the calculator opened without the user having to click anything. The chain used two memory bugs in the V8 JavaScript engine, a race condition (a bug caused by an unlucky timing of parallel processes) in CacheStorage, and a use-after-free (access to memory that has already been released) in the FedCM component. In total, Anthropic reported 62 Chrome vulnerabilities of critical or high severity. They are fixed as of Chrome 156 (released on October 20). According to Hacker News, Google's notes credit, among others, "Xinyang Ge of Anthropic, with the help of Claude."

Safari: The chain let JavaScript on any website read history, cookies and session data and send authenticated requests to other domains, without executing arbitrary code. According to Anthropic, several of the weaknesses used were actually intended behavior that only became exploitable in combination. In its iOS and iPadOS 26.5.2 notes, Apple credits "Milad Nasr and Nicholas Carlini with Claude, Anthropic" for a use-after-free in WebKit (CVE-2026-43715). One source dates the fix to late June.

Android: The model built an attack that could pull photos and personal data off a locked, stolen phone, using three vulnerabilities that bypassed USB data restrictions and the pairing check. It was tested on a Google Pixel 9. Anthropic says Google has fixed this; The Hacker News found no public entry for it.

Windows: The model found a remotely triggerable out-of-bounds read in the QUIC implementation of the Windows kernel. Servers that serve HTTP/3 with the native stack are affected. A few packets are enough to force a reboot. That's a denial of service, not code execution. Anthropic estimates several million vulnerable servers on the internet and points to CVE-2026-33096. Hacker News notes that this entry describes a flaw in HTTP.sys and names no discoverer.

Linux: The most serious case: a remote attacker with no credentials could execute commands as root, meaning with full access, on servers with Multipath TCP (MPTCP) enabled. In the proof of concept, reading out a kernel address took 48 minutes, and the subsequent command execution about five more. Anthropic links this to CVE-2026-98432, fixed in the mainline and stable branches. The public entry rates the flaw 9.8 out of 10 but describes a bug in the IPv4 TCP code and doesn't mention MPTCP, so the connection rests on Anthropic's report.

How the system works

Anthropic describes a platform that runs many analysis agents in parallel, measures how many unique vulnerabilities each contributes, and monitors the coverage of the code under review. Every confirmed finding goes through variant analysis and a standardized review and risk-assessment process. For Windows, the model received the binary and was asked to reverse-engineer it with tools such as Ghidra before hunting for prioritized bugs. The company recommends scanning code on every pull request to avoid new flaws, and has released a security plugin for Claude Code for that purpose.

What the report leaves out

Anthropic says every attack started from "initial instructions" and that some steps involved human guidance, but it doesn't quantify that share. False-positive rates, the total number of vulnerabilities found in the program, and the time per finding are also missing. The patches and vendor acknowledgments can be checked. The level of autonomy can't. Coordinated disclosure applied: 90 days for the vendor to fix the issue, then another 45 days before details beyond the advisories are published.

Our take

Anthropic argues that attacks like these used to be the preserve of specialized teams and can now be produced with little human effort. Defenders therefore need access to capable models to close holes before attackers do. To that end, it expanded the Cyber Verification Program, which gives qualified security professionals advanced capabilities with fewer classifier blocks. There is also a voluntary vulnerability-scanning service for open-source projects. Read the findings as vendor claims: the patches prove real finds, but without the model's identity and the share of human involvement, the achievement can't be put in context or reproduced. The case also shows the dual-use problem: the same capability helps defenders and attackers alike. For users, the usual advice applies: update your browser, operating system and servers promptly.