Anthropic has published a study claiming that an unreleased internal Claude model discovered vulnerabilities in Google Chrome, Safari, Android, Windows and Linux and chained them into five working exploit chains. According to Anthropic, all vulnerabilities were disclosed to vendors before publication and have already been patched. The exploits were created in laboratory conditions and have not been observed in real-world attacks. However, a number of the company’s key claims — in particular, about the degree of the model’s autonomy and the scale of the discovered vulnerabilities — rely mainly on Anthropic’s own report, and independent verification confirms only part of them.
What has been independently confirmed, and what has not
Anthropic’s central assertion — that a single model with “minimal human involvement” found several distinct vulnerabilities and combined them into a working exploit — has until now been the prerogative of highly specialized research teams. This claim rests solely on the company’s own report: Anthropic does not disclose exactly which steps were performed by a human at each stage and does not name the model, referring to it only as an “unreleased internal research model.”
There is, however, some partial independent confirmation. The Chrome 156 release notes list Xinyang Ge of Anthropic, with assistance from Claude, as the reporter of at least one fix. This confirms that the Claude model did participate in discovering Chrome vulnerabilities, but does not confirm the stated scale — 62 CVEs, 13 sandbox escapes and 21 vulnerabilities compromising the renderer.
Five exploit chains: technical details
Chrome: four-stage chain to code execution
According to Anthropic, the model used four separate vulnerabilities in sequence: a memory corruption bug in the V8 engine, a V8 sandbox escape, a race condition in CacheStorage to read the memory of the privileged browser process, and a use-after-free in FedCM to achieve code execution outside the sandbox. The demonstration exploit reportedly launched the Calculator app on a Mac with Chrome within seconds after a page was loaded, with no further user interaction. The fixes were included in Chrome 156 (builds 156.0.8078.47 for Linux, 156.0.8078.47/.48 for Windows and Mac), released on 20 October 2026.
Safari: same-origin policy bypass without code execution
The Safari chain is fundamentally different: according to Anthropic’s description, it does not execute arbitrary code but gains full read and write access to browser memory and disables the same-origin policy (the rule that prevents one site from reading another site’s data). As a result, a malicious page can read history and cookies and send authenticated requests to other sites. Apple has reportedly patched the central use-after-free vulnerability in iOS and iPadOS 26.5.2, crediting “Milad Nasr and Nicholas Carlini with Claude, Anthropic” as the authors. However, the publicly available Apple update page does not contain direct confirmation that this specific chain was addressed.
Windows: denial of service with description discrepancies
The Windows chain has the narrowest impact: it is a denial-of-service attack in which several network packets cause the machine to crash. Anthropic describes the vulnerability as an out-of-bounds read in QUIC handling by the Windows kernel. However, the CVE-2026-33096 entry on Tenable describes the affected component as HTTP.sys, the built-in Windows HTTP request handler, rather than the kernel’s QUIC subsystem. The CVSS score is 7.5 (High), and the impact is described as a network denial of service rather than remote code execution. The public CVE record, based on available data, does not list the discoverer, so attribution of this vulnerability to Anthropic and Claude is based only on the company’s own statement.
Linux: remote code execution as root
The most serious chain in terms of potential impact is the one targeting Linux. According to Anthropic, the exploit allows commands to be executed as root over the network without authentication, provided the target server is using a multipath TCP listener. The model first bypasses KASLR (kernel address space layout randomization), leaking a kernel memory address in 48 minutes, and then obtains a root shell in a further 5 minutes. Anthropic links this chain to CVE-2026-98432, which has a CVSS score of 9.8 (Critical). However, there is a discrepancy here as well: the CVE entry describes a use-after-free in IPv4 TCP, not in multipath TCP. The connection between the two descriptions is established only through Anthropic’s publication.
Android: lock screen bypass
Anthropic also reports that the model created an exploit to extract photos and personal data from a locked Android device. No CVE identifier or confirming Google advisory could be found for this vulnerability.
Discrepancies and limits of verification
Analysis of the available sources reveals several significant discrepancies between Anthropic’s statements and public vulnerability records:
- CVE-2026-33096: Anthropic describes a QUIC component in the Windows kernel, while the CVE registry lists HTTP.sys — these are different components, and open sources do not link them.
- CVE-2026-98432: Anthropic describes multipath TCP, the CVE registry — IPv4 TCP. The connection is made only in Anthropic’s publication.
- The claim of 62 CVEs in Chrome, including 13 sandbox escapes, is supported only by Anthropic’s report; the Chrome 156 release notes confirm attribution for individual fixes but not the entire volume.
- As of late October 2026, none of the vulnerabilities has been added to the CISA KEV catalog or marked as exploited in real-world attacks.
We have already taken a detailed look at the Chrome 156 update, in which Google closed hundreds of vulnerabilities, including those discovered with the help of AI tools.
Impact assessment
If Anthropic’s claims are accurate, this marks a qualitative shift in automated vulnerability discovery capabilities. A model capable of independently finding and combining vulnerabilities into exploit chains dramatically lowers the barrier to creating complex attacks — work that previously required months of effort from specialized teams.
The affected products cover virtually the entire spectrum of user platforms: Chrome and Safari are the two dominant browsers, Windows and Linux are the main server and desktop OSes, and Android is a mobile platform with billions of devices. The Linux chain poses the greatest risk (CVSS 9.8, remote code execution as root), although it requires a specific configuration with multipath TCP.
Recommendations
- Chrome: update to version 156.0.8078.47 or later. Check your current version via
chrome://version. - iOS/iPadOS: install the update to version 26.5.2 via “Settings → General → Software Update.”
- Windows: apply the latest security updates that address CVE-2026-33096.
- Linux: update the kernel to a version that includes the fix for CVE-2026-98432 (fixed upstream on 15 October). Servers with multipath TCP should be prioritized.
- For organizations using AI tools in security research: Anthropic offers access to Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1 through its Cyber Verification Program for verified professionals.
Anthropic’s publication marks an important moment: AI models are moving from a theoretical ability to find vulnerabilities to demonstrating working exploit chains. At the same time, a significant part of the company’s claims remains corroborated only by its own report. Regardless of how much trust one places in these claims, the practical takeaway is clear: all the described vulnerabilities have already been patched by vendors, and the top priority is to ensure your systems are updated to current versions of Chrome 156, iOS/iPadOS 26.5.2, and the latest Linux kernel and Windows patches.
