Unreleased Claude made 5 exploit chains, all fixed

An unreleased Claude built five exploit chains

On October 27, 2026, Anthropic's Frontier Red Team, the group that tests its models for dangerous capabilities, said a Claude model that has not been released to the public built working exploit chains against five products. An exploit chain links several vulnerabilities, or security weaknesses in software, so they work together as one attack. The targets were Chrome, Safari, Android, Windows and Linux, and most of the chains needed little or no action from the user.

For several months, the team had pointed an internal research model at browsers and operating systems to look for serious bugs. Both open-source and closed-source software were in scope. According to Anthropic, flaws in these products could reach billions of people.

Researchers gave the first prompt, and Claude did the rest

Anthropic says its researchers only wrote the opening prompt, and the model found the bugs and assembled each chain on its own. It has not named the model. It also has not said how much the researchers stepped in at each stage.

Seven people are listed as contributors, including Nicholas Carlini. All five attacks were run in test setups prepared for the research, not against real victims.

All bugs were reported under a 90-plus-45-day policy

Every vulnerability was reported to the affected vendor through coordinated disclosure, where a finder tells the developer first and gives them time to ship a fix. Under Anthropic's policy, a vendor gets 90 days to patch. After that, Anthropic waits another 45 days before it shares anything beyond what the vendor's own advisory says.

That is why the date of the post does not match the dates the bugs were fixed. By the time it was published, each vendor had already fixed or addressed the bugs used in the five chains.

Opening a web page was enough in Chrome and Safari

In both browsers, a person only had to load a booby-trapped web page for the attack to work. Browsers keep page code inside a sandbox, a walled-off area that stops it from touching the rest of the computer. Claude got past that wall by stringing several bugs together.

Chrome: four bugs chained, 62 CVEs fixed in Chrome 156

On a Mac running Chrome with default settings, opening the test page made the Calculator app pop up a few seconds later. Calculator was just a harmless stand-in to prove the page could run any program it liked, with the user's permissions and outside the sandbox. Nothing else had to be clicked, and the chain behind it relied on four separate bugs.

Google gave Anthropic's reports 62 CVEs, the public ID numbers assigned to known vulnerabilities, and all of them were fixed by Chrome 156. That figure counts every Chrome bug Anthropic reported, not the number used in one chain. Each was rated critical or high, and the list includes 13 sandbox escapes plus 21 bugs that could hijack the renderer, the part of Chrome that draws pages.

Safari: any site could read data from other sites

In Safari, the chain let JavaScript on any website get around the same-origin policy, the browser rule that stops one site from reading another site's data. With that rule gone, a page could pull up the user's Safari history and cookies. It could also send requests to other sites where the user was signed in and read what came back.

Anthropic gives examples such as reading someone's webmail, checking a bank balance or trying to move money. The attack never ran its own program and went straight for data, and some of the pieces it used were features working as designed. Apple confirmed the report on the day it arrived and shipped a fix that users can already install.

Android, Windows and Linux were hit too

Beyond browsers, Claude also built chains for Android phones and for servers running Windows or Linux. The Android attack needs the phone in hand, while the Windows and Linux attacks come in over the network. Because the starting conditions differ, the risk for each product has to be judged on its own terms.

A locked Pixel 9 gave up photos without the passcode

On Android, Claude wrote an attack that pulls photos and other personal data off a stolen phone while it stays locked. It got there by combining three lines of work:

• reading the open-source parts of Android
• taking apart the Google Play services app code
• testing on a real Google Pixel 9

The finished attack used three of the bugs it found. Among the protections it got around were the block on USB file transfers while the phone is locked and the six-digit code used to approve pairing.

The attacker has to have the phone physically. Google has addressed the issue.

Windows servers could be crashed, Linux servers taken over

On Windows, Claude found a way to knock over, from anywhere on the network, any machine that answers HTTP/3 web traffic through Windows' built-in support. The flaw is an out-of-bounds read in how the Windows kernel handles QUIC, the transport HTTP/3 runs on. A handful of packets makes the machine crash and reboot, and repeating them keeps it offline.

Microsoft fixed the bug after Anthropic reported it and gave it the ID CVE-2026-33096. Anthropic estimates there may be several million exposed servers on the internet.

On Linux, Claude's attack targets servers listening for multipath TCP, an extension that lets one connection use several network paths at once. Sending packets to such a server lets an outsider run commands as root, with no password and no user action. In the test, leaking a kernel memory address took 48 minutes, and reaching command execution took five more.

A failed attempt only breaks that connection rather than the whole system, so an attacker can keep retrying. The bug, CVE-2026-98432, was fixed upstream and the fix was carried into every maintained stable kernel.

Anthropic urges defenders to scan their own code

Anthropic closes the post by telling defenders that checking the code they write themselves now matters more than ever. In its view, fixing the bugs already out there is only half the job. The other half is stopping new ones from slipping in, so it recommends scanning each pull request, the review step before a code change is merged, and it has published a Claude Code plugin for that.

Chaining bugs used to take specialist teams

According to Anthropic, finding several bugs and turning them into one working attack used to be work that only a few expert teams could do. Frontier models can now handle that job with little human help. Anthropic argues that this is why defenders need strong models too, so they can patch before attackers move.

The team also found that running many scanning agents side by side, each using a different search approach, sharply raised the number of bugs found. Its open-source work turned up privilege-escalation bugs in OpenBSD, FreeBSD and Linux, as well as flaws in web apps.

Vetted security pros get models with fewer limits

Anthropic recently widened its Cyber Verification Program, which gives approved security professionals access to advanced cyber capabilities. Members also face safety classifiers that block fewer requests (related article: Anthropic Cyber Verification Program adds 3 tiers).

Members can use Claude Mythos 5.1 as well as Opus 5.5 and Sonnet 5.5. Anthropic says newer models will be added as they arrive.

Make sure the fixes are installed on company devices

All of these bugs have fixes, but a fix does nothing until it is installed on the company's own computers, phones and servers. Systems that have not been updated stay exposed even to flaws the vendor has already closed.

Japan's Information-technology Promotion Agency (IPA) ranks attacks that exploit system vulnerabilities fourth on its 2026 list of top threats to organizations. The threat first made the list in 2016, and this is its ninth appearance.

Companies: update Chrome, each OS and Linux kernels

IT teams should confirm that the fixes have actually reached every company laptop, phone and server. Use these targets as a guide:

• Chrome: version 156 or later
• Windows, macOS, iOS and Android: the latest update from each vendor
• Linux: a kernel that includes the CVE-2026-98432 fix

Auto-update alone is not proof, because browsers and operating systems often keep running the old version until they restart. Servers that accept HTTP/3 or multipath TCP connections from outside can be attacked over the network, so patch those first. Keeping a list of which servers have these features turned on will also speed up the response the next time a similar bug appears.

Staff: update promptly and keep phones on you in public

Employees should install browser and phone updates as soon as they are offered, then restart. The Chrome and Safari chains only needed a web page to be opened, and an updated browser shuts out the bugs used in them.

The Android attack only works when someone has the phone in their hands. Do not leave work or personal phones unattended on a train or in a cafe, and report a lost phone to IT right away.