Anthropic Says Unreleased Claude Built Working Multi-OS Exploit Chains
Anthropic’s Frontier Red Team showed an unreleased model chained vulnerabilities into working exploits across five operating environments.
In short
- According to Anthropic, an unreleased Claude research model discovered vulnerabilities and chained them into functional exploits across Chrome, Safari, Android, Windows, and Linux.
- Demonstrated exploits included a zero-click remote-root shell on Linux and a one-click macOS Chrome sandbox escape that launched the Calculator app.
- Anthropic disclosed all vulnerabilities to affected vendors under a coordinated disclosure policy, and vendors released patches before publication.
- Vendor advisories from Apple, Google, and Microsoft credit Anthropic researchers assisted by Claude, though some external records describe underlying components differently.
- Anthropic is expanding its Cyber Verification Program and promoting PR-time scanning tools to help defensive teams find flaws before attackers.
On October 27, 2026, Anthropic disclosed that an unreleased, internal Claude research model discovered critical vulnerabilities across several of the world's most widely used platforms and chained them into working, end-to-end exploits. Conducted in laboratory environments by Anthropic's Frontier Red Team, the testing spanned five major targets: Google Chrome, Apple Safari, Android on a physical Google Pixel 9, Microsoft Windows, and the Linux kernel. The company reported all flaws to the respective vendors under a coordinated disclosure program prior to releasing its research, and the issues have been patched.
According to The Hacker News, the strongest finding is not just the discovery of individual bugs, but the model's ability to autonomously combine multiple distinct weaknesses into working multi-step exploits with little human intervention beyond initial prompting.
Breaking Browser Defenses in Chrome and Safari
In testing on macOS with a default, stock configuration of Chrome, the unreleased Claude model produced a one-click remote code execution chain that escaped the browser's sandbox. The demonstration launched macOS's Calculator application within seconds of loading a malicious web page, requiring no further interaction from the user.
To construct the full Chrome exploit, the model identified and chained four separate vulnerabilities:
- A memory corruption flaw in Chrome's V8 JavaScript engine that corrupted heap memory.
- A second flaw allowing an escape from V8's memory sandbox and defeating address space layout randomization (ASLR) to hijack the renderer process via a return-oriented programming (ROP) chain.
- A race condition in CacheStorage used by the compromised renderer to read memory outside its sandbox and map the memory layout of the privileged browser process.
- A use-after-free bug in FedCM, Chrome's federated sign-in mechanism, enabling arbitrary code execution outside the process sandbox.
Anthropic reported that Google assigned 62 CVEs—all rated high or critical, including 13 sandbox escapes and 21 renderer compromise flaws—which were patched as of Chrome 156 on October 20, 2026. Release notes from Google credited Anthropic researcher Xinyang Ge, assisted by Claude, for specific fixes, though Audit Commons noted that public vendor notes could not easily reconcile the full count of 62 CVEs.
In Safari, Claude bypassed the same-origin policy (SOP) without executing arbitrary code, as detailed by Cyber Security News. The chain exploited a use-after-free flaw in JavaScriptCore, circumvented WebKit's Gigacage memory protection, and abused an inter-process communication (IPC) vulnerability in the WebContent sandbox. This allowed a malicious site to read browser history, session databases, and cookies directly from disk, potentially permitting attackers to read emails or access online bank accounts. Apple patched the issue in iOS and iPadOS 26.5.2 on June 29, 2026, crediting Anthropic researchers Milad Nasr and Nicholas Carlini with Claude.
Operating System Exploitation Across Android, Windows, and Linux
Beyond browsers, the research model identified and combined weaknesses in mobile and server operating environments. On Android, Claude targeted a physical Google Pixel 9 to extract photos and other files over USB without unlocking the handset. The attack bypassed USB data blocks, pairing authorization checks, and six-digit passcode verifications by identifying an unverified fallback mechanism that transferred raw file bytes. Google addressed the flaw, according to Anthropic, though independent observers found no public vendor advisory.
On Windows, Claude conducted binary analysis using reverse-engineering tools like Ghidra to locate a remote denial-of-service vulnerability. By sending a few network packets to an internet-exposed server handling HTTP/3 requests, the exploit triggered an out-of-bounds read that repeatedly crashed and restarted the host. Anthropic estimated several million servers listen for such traffic. Microsoft patched the flaw under CVE-2026-33096 in April 2026. While Anthropic described the bug as a memory safety issue in the kernel's QUIC implementation, public vulnerability records from the National Vulnerability Database and Microsoft associate CVE-2026-33096 with HTTP.sys, assigning it a 7.5 CVSS score.
The most severe demonstration involved the Linux kernel networking stack, resulting in a zero-click remote code execution chain. Target systems required an active multipath TCP listener. Claude chained a race-condition-induced use-after-free bug across two stages: first leaking a kernel pointer to defeat kernel address space layout randomization (KASLR), and then hijacking control flow to execute arbitrary shell commands as root. Because a failed race only aborted the connection handshake without crashing the operating system, repeated attempts were possible. In Anthropic's test, leaking the pointer took 48 minutes, followed by five minutes to spawn a root shell. The bug was patched upstream on October 15, 2026, under CVE-2026-98432 with a 9.8 CVSS rating, though public database entries label it an IPv4 TCP fix without mentioning multipath TCP.
Research Methods and Implications for Defenders
Anthropic attributed the model's discovery rate to parallel scanning agents, diverse exploration strategies, and test-time compute scaling. The system combined goal-based scans, coverage checks, and threat-model verification with automated variant analysis.
As reported by Notebookcheck, the research team emphasized that advanced model capabilities can level the playing field for defenders if deployed proactively. To support defensive teams, Anthropic expanded its Cyber Verification Program, which provides vetted security professionals with access to models including Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1 with reduced blocking classifiers. The company also released a security guidance plugin for Claude Code to encourage scanning software changes at pull-request time.
While external analysts from Audit Commons observed that public vendor records confirm Anthropic's bug reports, the internal level of human involvement during the research runs remains undisclosed outside Anthropic's own descriptions.
Questions people ask
Were these Claude exploit chains used in real-world attacks?
No. Anthropic conducted these demonstrations in isolated lab settings and reported all discovered vulnerabilities to the affected software vendors before publication. The vulnerabilities have been patched, and there is no evidence of real-world exploitation.
Which platforms were affected by the vulnerabilities discovered by Claude?
The research model constructed exploits targeting Google Chrome, Apple Safari, Android on a physical Google Pixel 9, Microsoft Windows servers handling HTTP/3, and Linux kernel systems running multipath TCP listeners.
How can security professionals access Anthropic's cyber research models?
Anthropic provides access to its advanced models, including Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1 with reduced blocking classifiers, to vetted personnel through its Cyber Verification Program.
Sources
- Discovering and exploiting vulnerabilities in critical, real-world software with ClaudeAnthropic, Oct 27, 2026, official source
- Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux ExploitsThe Hacker News, Oct 28, 2026
- Claude AI Builds One-Click Chrome and Zero-Click Linux Exploit Chains, Bypasses Android Lock Screencybersecuritynews.com, Oct 28, 2026
- Anthropic's secret AI extracted data from a locked Android phone and escaped Chrome's sandboxNotebookcheck, Oct 28, 2026
- Anthropic Says an Unreleased Model Built Exploit Chains for Chrome, Safari, Android, Windows, and LinuxAudit Commons, Oct 27, 2026
- Anthropic's Frontier Red Team Says Unreleased Claude Chained Flaws Into Working Chrome, Safari, Android, WindoAI Weekly, Oct 28, 2026
How this story was made: the newsroom picked it up from Google Search, gathered the full text of the sources above, and drafted it with AI assistance. Every factual claim was then checked against those sources before publishing (37 claims checked). Illustrations marked as AI-generated are not photographs. Spotted an error? Tell us.
Published October 29, 2026 at 01:08 UTC
