Anthropic reports AI-built exploit chains across major platforms
Anthropic says an unreleased internal research model identified flaws and combined them into five working proof-of-concept exploit chains affecting Chrome, Safari, Android, Windows and Linux. The company says the demonstrations were created in a laboratory after prompting, were not used in real-world attacks, and every vulnerability was reported to the relevant vendor before publication.
The reported outcomes range from browser sandbox escape to data access, denial of service and remote root command execution. Anthropic’s central claim is that one model connected several separate vulnerabilities into usable chains, a task it says has traditionally required specialist security teams. The model has not been publicly named, and Anthropic does not provide a step-by-step account of the human contribution to each chain.
Five chains and their patch status
The Chrome proof of concept could run code outside the browser sandbox after a page visit or click on a stock macOS installation. Anthropic says it combined four flaws: a V8 memory corruption issue, an escape from V8’s memory sandbox, a CacheStorage race condition and a use-after-free bug in FedCM. The company reported 62 Google issues assigned CVEs, including 13 sandbox escapes, which it says were fixed by Chrome 156 on October 20.
Google’s release notes credit Xinyang Ge of Anthropic, assisted by Claude, for particular Chrome fixes, though not for all 62 issues. Anthropic demonstrated one chain by opening Calculator on a stock Mac running Chrome seconds after a page loaded, without further interaction.
The Safari chain did not execute code. Instead, Anthropic says it obtained read and write access to browser memory and changed a value that disabled the same-origin policy. A malicious site could then read history and cookies or issue signed-in requests to other sites. Apple fixed the central use-after-free issue in iOS and iPadOS 26.5.2 and credits Milad Nasr and Nicholas Carlini with Claude, Anthropic.
The Android demonstration required physical USB access to a locked stolen phone and could copy photos and other data. Anthropic says Google has fixed the issue, but no public record was identified in the report.
Windows and Linux claims need careful interpretation
The Windows chain is described as a network denial-of-service condition: a small number of packets crashes a server and repeated packets can keep it unavailable. Anthropic links it to CVE-2026-33096, patched in April 2026. The public CVE describes an HTTP.sys vulnerability with a 7.5 severity rating, while Anthropic describes an out-of-bounds read in Windows kernel QUIC handling; public records do not establish that these descriptions refer to the same component.
As of late October, U.S. vulnerability enrichment marked CVE-2026-33096 as not exploited, and it was not listed in CISA’s catalog of known exploited vulnerabilities. The CVE record identifies no finder, so Anthropic’s role in discovering that flaw rests on the company’s account.
The Linux chain is presented as the highest-impact example because it could run commands as root over the network without a login or user interaction. It requires a server running a multipath TCP listener. Anthropic says the chain first leaked a kernel address to bypass KASLR, then used a race condition to redirect execution and obtain a root shell. Its proof of concept took 48 minutes to leak the address and another five minutes to reach the shell.
Anthropic associates the Linux finding with CVE-2026-98432, a kernel use-after-free rated 9.8 and fixed upstream on October 15. The public CVE record describes an IPv4 TCP fix rather than a multipath TCP issue, so that linkage is likewise supported by Anthropic’s report rather than an independent public record.
What security teams should do
Anthropic says it followed coordinated disclosure rules that allow 90 days for patches and a further 45 days before technical discussion beyond an advisory. Vendor acknowledgements substantiate some findings, while the extent of autonomous model work remains unverified outside Anthropic’s account.
For businesses, the immediate implication is practical: verify deployment of Chrome 156, iOS and iPadOS 26.5.2, the relevant Windows updates and the Linux kernel fixes, then review internet-facing HTTP/3 and multipath TCP services for exposure.