Anthropic AI model chained flaws into Chrome, Safari, Android, Windows and Linux exploits

What happened

Anthropic’s Frontier Red Team published a research post describing five exploit chains produced by an unreleased internal research model. The model found separate flaws and combined them into working proofs of concept after “initial prompting” (The Hacker News, MediaNama). The exploits were built in the lab and were not seen in any real attack. Anthropic reported every flaw to the vendor first (The Hacker News).

The five chains, as reported:

• Chrome: Four flaws were used in turn, covering V8 memory corruption, a V8 sandbox escape, a CacheStorage race condition and a FedCM use-after-free. The result is code execution outside the browser sandbox from one page load. The proof of concept opened Calculator on a stock Mac running Chrome. Anthropic says it reported 62 flaws to Google, all with CVEs, all rated critical or high, fixed as of Chrome 156 (October 20), including 13 sandbox escapes (The Hacker News, MediaNama).
• Safari: A data-only chain that turns off the same-origin policy, letting a malicious page read history, cookies and signed-in sessions on other sites. Apple fixed the central use-after-free in iOS and iPadOS 26.5.2 (June 29) (The Hacker News). No CVE identifiers were given for Safari (MediaNama).
• Android: Three flaws in device-transfer and USB handling were chained to copy photos and other data off a locked Google Pixel 9. It needs physical access over USB. Anthropic says Google fixed it, but no public record was found (The Hacker News, Dark Reading).
• Windows: A denial of service. A few crafted packets crash a server that answers HTTP/3 requests, and repeating them keeps it down. It does not run code or steal data. Microsoft addressed it under CVE-2026-33096 (patched April 2026, rated 7.5) (The Hacker News, MediaNama).
• Linux: The most serious in impact. A remote attacker with no login and no user action can run commands as root on a server running a multipath TCP listener. The proof of concept took 48 minutes to leak a kernel pointer and five more to reach a shell, and a lost race does not crash the system, so attempts can be repeated. It is tied to CVE-2026-98432 (rated 9.8, fixed upstream October 15, backported to all maintained stable kernel branches) (The Hacker News, MediaNama).

Caveats from the reporting:

• The capability claim rests on Anthropic’s own account. Anthropic does not break down what humans did at each step and does not name the model (The Hacker News). It also gives no success rates, costs or attempt counts (MediaNama).
• Anthropic describes the Windows flaw as a QUIC issue in the kernel, but the public record for CVE-2026-33096 names HTTP.sys and credits no finder. No open source ties the two descriptions together as the same component (The Hacker News).
• The public record for CVE-2026-98432 describes an IPv4 TCP fix rather than a multipath TCP one, and the two are linked only by Anthropic’s post (The Hacker News).
• Outside commentators note that proof of concept to reliable real-world attack still takes target-specific work. They cite a VulnCheck figure of 1.3% of AI-discovered vulnerabilities confirmed exploited in the wild (Dark Reading).

Anthropic also says it is expanding its Cyber Verification Program, which gives vetted professionals access to Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1 (The Hacker News, Dark Reading).

Am I affected?

You are only exposed if you have not applied the fixes.

• Chrome: Any build older than Chrome 156. The proof of concept targeted stock Chrome on macOS. Other platforms are not confirmed in the sources.
• Safari and Apple devices: iOS and iPadOS older than 26.5.2. The macOS Safari fix version is not confirmed in the sources.
• Android: The chain was demonstrated on a Pixel 9 and needs physical access. Which other devices and patch levels are affected is not confirmed.
• Windows servers: Machines that answer HTTP/3 requests through the native Windows implementation and lack the CVE-2026-33096 update. Anthropic estimates several million such servers are exposed to the internet (MediaNama).
• Linux servers: Hosts running a multipath TCP listener on a kernel without the CVE-2026-98432 fix. Kernels and distribution packages that include the backport are not individually confirmed in the sources.

What to do now

1. Update Chrome to version 156 or later on all managed endpoints and confirm with your fleet inventory.
2. Update iPhones and iPads to iOS and iPadOS 26.5.2 or later. Check Apple’s advisories for the matching macOS and Safari releases, since they are not confirmed here.
3. Apply the current Windows security updates, including the fix for CVE-2026-33096, on any server that answers HTTP/3.
4. On Linux servers, check whether a multipath TCP listener is enabled. Install a vendor kernel that includes the CVE-2026-98432 fix and reboot. If you cannot patch yet, consider whether the MPTCP listener is needed on exposed hosts.
5. Keep Android and Google Play services current. Physical custody of lost or stolen devices matters for the USB-based Android chain.
6. Scan your own code. Anthropic’s advice to defenders is that scanning your own code is more important than ever, and commentators warn the same capability applies to less-scrutinized code such as router and camera firmware (Dark Reading).
7. Treat the exploitation status as unchanged. As of late October, CVE-2026-33096 was not marked exploited and was not in the CISA known exploited catalog, but recheck as the story develops (The Hacker News).

Sources

• The Hacker News: Anthropic’s Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
• Dark Reading: Claude Model Builds Exploits Across Major Browsers and OSes
• MediaNama: Anthropic’s Claude AI found ways to hack Chrome, Android, Windows and Linux