Anthropic says an unreleased internal Claude research model identified critical vulnerabilities in Chrome, Safari, Android, Windows and Linux, then built five multi-step exploit chains that could expose personal data, execute code or disrupt servers with little or no user interaction.
The company detailed the work in its October 27 research report, expanding on its earlier Chrome vulnerability research. Anthropic said it reported the findings to affected vendors through coordinated disclosure.
In Chrome, the model chained memory-corruption flaws with weaknesses in the browser’s sandbox protections and a race condition to execute code outside the renderer sandbox as the logged-in user. Anthropic says 62 vulnerabilities from its Chrome research have been assigned CVE identifiers and patched as of Chrome 156. The company said the group includes 13 sandbox escapes and 21 flaws that could have been used to compromise the renderer.
The Safari chain allowed a malicious website to bypass the browser’s same-origin policy, potentially exposing browsing history, cookies and other sensitive data while making authenticated requests to other websites. Anthropic said Apple acknowledged the report and implemented a fix. On Android, the model combined weaknesses in USB and device-to-device transfer protections to extract photos and other personal information from a locked Pixel 9 without unlocking the phone. Anthropic said Google has addressed that issue.
Anthropic also reported that the model found a remotely exploitable denial-of-service flaw in the Windows kernel’s native QUIC implementation. Tracked as CVE-2026-33096, the vulnerability could allow an attacker to crash a Windows machine by sending a small number of network packets to a service handling HTTP/3 traffic. Microsoft fixed the issue after Anthropic reported it.
The Linux research produced a more serious proof of concept. Anthropic says Claude wrote an exploit for a race-condition use-after-free flaw in the kernel networking stack that could let a remote attacker run arbitrary commands as root on a server with a multipath TCP listener, without credentials or user interaction. Tracked as CVE-2026-98432, the exploit took about 48 minutes to disclose a kernel pointer and another five minutes to reach command execution in Anthropic’s test. The vulnerability has been patched upstream and backported to maintained stable kernel branches.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
