Anthropic exploit chains from an unreleased internal model reached lab proof-of-concept attacks on Chrome, Safari, a locked Pixel 9, Windows, and Linux, the company’s Frontier Red Team said in its research post. The chains led to remote code execution and other critical effects with little to no user interaction, according to Anthropic’s research post. Every flaw was reported before disclosure, and Anthropic says the affected vendors have already shipped fixes.
Key Takeaways
- Unreleased Anthropic model chained lab exploits against Chrome, Safari, Android, Windows, and Linux.
- Google patched 62 high or critical Chrome CVEs, including 13 sandbox escapes.
- Public record for CVE-2026-33096 names HTTP.sys; it is not in CISA’s KEV.
- Linux root chain needs multipath TCP and is tied to a 9.8-rated kernel bug.
What the Anthropic Exploit Chains Covered
The Hacker News reported that the chains were lab work after prompting, not attacks in the wild, and that patches were already out. Anthropic does not name the model or itemize each human step. Credits in vendor notes can be checked; the unaided share of each chain cannot.
| Target | Lab impact | Record | Fix |
|---|---|---|---|
| Chrome | One-click code execution outside the sandbox | 62 high or critical CVEs | Patched as of Chrome 156 |
| Safari | Same-origin bypass; history and cookies readable | Use-after-free, data-only chain | iOS and iPadOS 26.5.2 |
| Pixel 9 | Photos and personal data from a locked phone | CVE not stated | Addressed by Google |
| Windows | Remote crash; repeat packets keep the host down | CVE-2026-33096 names HTTP.sys, rated 7.5 | Resolved by Microsoft |
| Linux | Zero-click commands as root | CVE-2026-98432, rated 9.8 | Upstream fix on October 15 |
Chrome, Safari, and a Locked Pixel 9
Anthropic says the chain used separate flaws, including a V8 memory bug and a FedCM use-after-free, to run arbitrary code as the user outside the sandbox. A proof of concept launched the Calculator app on a stock default-configuration Chrome browser on macOS within seconds of the page loading, with no further clicks. It reported 62 CVEs patched as of Chrome 156, all critical or high, including 13 sandbox escapes and 21 vulnerabilities that could have been used to compromise the renderer. The Hacker News reported that Google’s notes credit “Xinyang Ge of Anthropic, assisted by Claude” for specific fixes, not all 62.
The Safari chain does not execute attacker code. Anthropic calls it a data-only attack that turns off the same-origin policy so a page can read history and cookies and send authenticated requests elsewhere. Apple acknowledged the report the same day. The Hacker News said the use-after-free was fixed in iOS and iPadOS 26.5.2 and credited “Milad Nasr and Nicholas Carlini with Claude, Anthropic.”
The Pixel 9 case needs the phone in hand. Anthropic says flaws in open-source Android and Google Play services were chained so a locked device would yield photos and other personal data without an unlock. Google has addressed it.
Windows Crash Bug and Linux Root Chain
The Windows chain is a remote denial of service, not code execution. Anthropic describes an out-of-bounds read in kernel QUIC handling: a few packets crash and restart a host answering HTTP/3 on the native stack, and repeats can hold it down. Anthropic estimates several million such servers. It says Microsoft assigned CVE-2026-33096 and resolved the issue it reported.
Those details are not independently aligned. The Hacker News reported that the public record for CVE-2026-33096 names HTTP.sys, scores 7.5, credits no finder, and is not tied by any other source to the QUIC description. As of late October it was not exploited and not in the CISA KEV catalog. That gap is not a reason to defer Microsoft’s fix.
Linux is the highest-impact chain: Anthropic says a remote attacker can send packets to a multipath TCP listener and run commands as root, with no login, by abusing a race-condition use-after-free. Anthropic says the proof of concept took 48 minutes to leak a kernel address and five more to reach a shell, and a failed attempt does not crash the system. It ties the work to CVE-2026-98432, rated 9.8 and fixed upstream on October 15. The public CVE text describes an IPv4 TCP fix; The Hacker News noted that only Anthropic’s post links it to multipath TCP.
Patch Actions for IT and Security Teams
Vendors had 90 days to patch under Anthropic’s policy, plus 45 days before detail beyond a public advisory. The Hacker News quoted the company’s reason for publishing now:
Now, it’s something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify.
That is Anthropic’s claim, not an outside audit. Teams comparing this with frontier training kept off the live internet should separate research access from training controls. The action that reduces risk is still the vendor patch.
- Update Chrome to version 156 or later, covering the 62 high and critical CVEs.
- Install iOS and iPadOS 26.5.2 and any other Safari fix Apple has released.
- Apply Google’s Android fix before a lost phone returns to normal use.
- Install Microsoft’s resolution for CVE-2026-33096; the public record names HTTP.sys and does not confirm Anthropic’s HTTP/3 description.
- Install a kernel that includes the October 15 upstream fix for CVE-2026-98432 and review multipath TCP listeners.
Anthropic’s Cyber Verification Program offers vetted professionals Claude Opus 5.5, Sonnet 5.5, and Mythos 5.1. It does not replace those updates.
