Claude security vulnerabilities: exploits for Chrome, Safari and Linux

On October 27, Anthropic’s Frontier Red Team described five exploit chains built by “an unreleased, internal research model”. Over the past few months the model hunted for security vulnerabilities in Chrome, Safari, Android, Windows and Linux, and on every one of those systems it got all the way to a critical attack with minimal user interaction, or none at all.

Which security vulnerabilities did Claude find?

In each of the five cases, after the initial prompting, Claude wrote the entire chain on its own:

1. Chrome: one-click remote code execution. The chain combines a bug in the V8 engine, a V8 sandbox escape, a race condition in CacheStorage and a use-after-free in FedCM (Chrome’s sign-in mechanism). In the demo, Calculator pops up on macOS a few seconds after the page loads. By Chrome 156, 62 CVEs had been assigned and patched, all rated “critical” or “high”.
2. Safari: one-click data theft. No code execution here: a use-after-free in JavaScriptCore, a Gigacage isolation bypass and a weakness in the sandbox IPC let the model read history, cookies and sessions from disk, and then switch off the same-origin policy. According to Anthropic, Apple acknowledged the report the same day and quickly shipped a fix.
3. Android: lock screen bypass. The model pulled photos and personal data off a locked Google Pixel 9 by combining code analysis, reverse engineering of Google Play services binaries and testing on a physical phone. Google has already fixed it.
4. Windows: remote DoS. An out-of-bounds read in the Windows kernel’s QUIC implementation, reachable over HTTP/3. A handful of packets is enough to make the machine hang and reboot. By Anthropic’s estimate, there are probably several million such servers on the internet. Microsoft patched it as CVE-2026-33096.
5. Linux: zero-click root. The most serious case: a remote attacker sends packets to a server with a multipath TCP listener and runs arbitrary commands as root, with no credentials and no user interaction. In the proof of concept, leaking a kernel pointer takes 48 minutes, and getting to command execution takes another five. The fix landed in the mainline kernel and in every maintained stable branch (CVE-2026-98432).

On top of that come local privilege escalations in OpenBSD, FreeBSD and Linux, sandbox escapes and plenty of bugs in web applications.

What’s new here for AI?

First, the targets. Chrome, Safari, Android, Windows and Linux are some of the best-defended software in the world, and Anthropic’s team explicitly treats them as a test of what models can do in vulnerability research.

Second, the length of the chains. These aren’t single bugs but multi-stage attacks, where each step gets past another layer of protection (sandbox, ASLR, memory isolation). For Windows, Claude first reverse engineered the executable, using Ghidra among other tools, wrote an annotated reconstruction of the code in C, and only then looked for bugs in it.

Third, scale. Anthropic built a platform where many scanning agents run in parallel, each scored by how many new vulnerabilities it adds. For every confirmed bug, Claude automatically looks for similar variants elsewhere in the code. As the write-up puts it, this is something models can now do “with little human involvement”.

As we know, a day later Google showed off Gemini 4 Carbon, which is also built for bug hunting, and before that Bank of America brought in 1,000 contractors to patch what Claude Mythos had found. It looks like the race between models in cybersecurity is speeding up.

When will this model be available?

We don’t know. The article gives neither the model’s name nor a release date.

What we do know is what’s available today. Anthropic has expanded its Cyber Verification Program, where verified security professionals get access to advanced cyber capabilities and less restrictive classifiers. The program covers Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1, and, according to the announcement, upcoming new models as well.

What should you watch out for?

First, disclosure. All the vulnerabilities were reported to vendors under coordinated vulnerability disclosure: the vendor gets 90 days to ship a fix, and Anthropic waits another 45 days before saying more than the public advisory. The cases described are already patched, so the practical move is simply to update your browsers, phones and kernels.

Second, your own code. Anthropic says outright that clearing the backlog is only half the problem and that scanning your own code is “more important than ever”. For scanning at the pull request stage, the company released the security-guidance plugin for Claude Code. I wrote more about securing your own agents in my AI agent security guide.

Third, the other side of the coin. If a model can put together a zero-click root on Linux by itself, similar tools will probably end up in attackers’ hands too, which explains why Anthropic is so careful about access.

FAQ

Are the security vulnerabilities Claude found already patched?

According to Anthropic, yes: Chrome (up to version 156), Safari, Android, Windows (CVE-2026-33096) and Linux (CVE-2026-98432) already have fixes.

Which Claude model found these vulnerabilities?

An unreleased, internal research model. Anthropic hasn’t given its name or a release date.

Can I use Claude to find vulnerabilities in my own code?

Yes. For pull request reviews there’s the security-guidance plugin for Claude Code, and security professionals can apply to the Cyber Verification Program for less restricted access to Opus 5.5, Sonnet 5.5 and Mythos 5.1.