Anthropic announced that an unreleased research model called Claude successfully developed working exploit chains for Chrome, Safari, Android, Windows, and Linux.
The company’s Frontier Red Team shared these findings on October 27, 2026. Many exploit chains required minimal or no user interaction, and the team reported every identified flaw to the respective vendor before publication.
How Claude Broke Into Chrome
The Chrome chain is the most striking. After a first prompt, Claude wrote a full exploit that ran code outside the browser sandbox. The proof of concept opened the Calculator app on macOS seconds after a page loaded.
Claude first found a bug in V8, Chrome’s JavaScript engine, to corrupt heap memory. It then found a second flaw that let it escape the V8 memory sandbox and defeat ASLR. Next, it used a race condition in CacheStorage to learn the layout of the privileged browser process.
A use-after-free in FedCM, the federated sign-in feature, gave the final jump out of the sandbox. Google assigned 62 CVEs, and Chrome 156 fixed them all. Thirteen were sandbox escapes. You can read more about that release in our Chrome 156 patch coverage.
This is not the first sign of the trend. Earlier this year, a researcher showed that Claude Opus helped build a working V8 exploit against an outdated Chromium build in Discord Desktop.
The Safari chain let any website bypass the same-origin policy. That could expose history, cookies, and logged-in sessions such as email or banking. Claude did it without running arbitrary code. It only changed a security flag, an object size, and a URL in memory. Apple acknowledged the report the same day and has shipped a fix.
On Android, Claude pulled photos and personal data from a locked Google Pixel 9. It chained three flaws. One skipped the USB data block, one skipped the pairing authorization check, and one skipped the six-digit code check. A fallback path then sent raw file bytes over USB. Google has fixed the issue.
Claude also found a remote crash bug in the Windows kernel’s QUIC code, tracked as CVE-2026-33096. A few packets could crash and restart a server that answers HTTP/3 requests. Anthropic estimates several million such servers face the internet. Claude found it by reverse engineering the Windows binary with tools such as Ghidra.
The Linux case is the most serious. Claude built a zero-click exploit for servers with a multipath TCP listener. A remote attacker with no login could run commands as root.
The root cause is a race condition that leads to a use-after-free in the kernel networking stack. First, the exploit leaks a kernel address to defeat KASLR, which took 48 minutes in the test.
Then it overwrites a callback pointer and runs a shell command in about five more minutes. A failed attempt does not crash the system, so an attacker can retry as often as needed. The flaw is tracked as CVE-2026-98432 and is patched in all maintained stable kernels.
Anthropic says two lessons stand out. Running many different scanning agents in parallel finds far more bugs. Teams should also scan code at pull request time so new flaws do not pile onto the old backlog. The company released a free security-guidance plugin for Claude Code for that purpose. Our earlier report covers how the plugin works.
The wider point is speed. Skills once limited to a few expert teams can now be done with little human help. Anthropic is also widening its Cyber Verification Program so vetted defenders get stronger tools. Its partners found at least 129,000 verified flaws between April and July 2026.
The same power can help attackers, which is why patching fast and scanning your own code matters more than ever.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
