Anthropic: Claude wrote exploit chains for Chrome, Safari, Android and Linux
Anthropic reports that an unreleased Claude model found and exploited real flaws in the browsers and operating systems most people run.
· Anthropic · Research by Nicholas Carlini (Anthropic Frontier Red Team), David Dworken (Anthropic Frontier Red Team), Xinyang Ge (Anthropic Frontier Red Team), Ben Morris (Anthropic Frontier Red Team), Milad Nasr (Anthropic Frontier Red Team), Chris Rohlf (Anthropic Frontier Red Team), Luna Tong (Anthropic Frontier Red Team)
Anthropic's Frontier Red Team says an unreleased Claude model found flaws in Chrome, Safari, Android, Windows and Linux and wrote working exploit chains for five, including a zero-click remote root bug in the Linux kernel.
01What happened
Anthropic's Frontier Red Team published the work on October 27, 2026, naming Nicholas Carlini, David Dworken, Xinyang Ge, Ben Morris, Milad Nasr, Chris Rohlf and Luna Tong as contributors. The team says an unreleased internal research model found vulnerabilities in widely used browsers and operating systems, and that it wrote exploit chains for five of them. Anthropic says the findings went to vendors under its coordinated vulnerability disclosure policy.
02How it works
Many scanning agents run in parallel, each scored by how many unique vulnerabilities it adds and tracked by code coverage, across coverage-based, goal-based and threat-model-based strategies. Every confirmed finding then goes through automated variant analysis, which looks for the same mistake elsewhere, and through a verification and risk-rating pipeline. For the Windows bug, Anthropic says Claude reverse-engineered the binary with tools including Ghidra, wrote an annotated reimplementation, and checked it against the original.
03Who is affected
Chrome users were exposed until version 156, which Anthropic says carries fixes for 62 CVEs it reported, all rated critical or high, among them 13 sandbox escapes and 21 renderer compromise bugs. The kernel findings are tracked as CVE-2026-98432 on Linux and CVE-2026-33096 on Windows, and Anthropic estimates several million listening servers could be affected by the Windows one. Anthropic says Apple and Google have addressed the Safari and Android findings.
04What to do
Apply the vendor patches the report names, starting with Chrome 156 and the Linux stable kernels that carry the backported fix for CVE-2026-98432. Anthropic recommends scanning your own code at pull-request time rather than only working through an existing backlog. Security professionals with qualifying credentials can apply to Anthropic's Cyber Verification Program for access to its most capable models.
Questions people ask
- Which Chrome version fixes the vulnerabilities Anthropic reported?
- Chrome 156 carries the fixes, according to Anthropic's report. Anthropic says Google assigned 62 CVEs to its submissions, all rated critical or high, including 13 sandbox escapes and 21 renderer compromise bugs. Anthropic also describes a one-click chain on macOS that escaped the renderer and then the sandbox to reach code execution.
- Did Anthropic use a public Claude model for this work?
- No. Anthropic says the vulnerabilities were found with an unreleased internal research model, not one available in the Claude apps or the Claude API. The Frontier Red Team ran many scanning agents in parallel against the targets, scored each agent by the unique vulnerabilities it added, and tracked code coverage across three scanning strategies.
- Are the Linux and Windows kernel bugs patched?
- Yes for Linux: Anthropic says CVE-2026-98432, which it describes as a zero-click remote root code execution bug in the kernel's multipath TCP code, was patched upstream and backported to stable branches. For Windows, CVE-2026-33096 is a remote denial of service in the kernel's HTTP/3 implementation, and Anthropic estimates several million listening servers could be affected.
Sources 3 links, all fetched
- 1anthropic.comFrontier Red Team Post
- 2tenable.comLinux Kernel CVE
- 3anthropic.comDisclosure Policy