Anthropic's Unreleased Claude Hacked Chrome and Linux: Are You Patched?

An unreleased Anthropic model chained real bugs into working exploits for Chrome, Safari, Android, Windows and Linux. All are patched. Here's what to update now.

TheTechLane cover with the TL logo on a cream and oxblood blueprint-style background, five linked chain blocks labelled Chrome, Safari, Android, Windows and Linux, and the headline "Can AI Chain the Exploit Itself?"

Anthropic says an unreleased, internal Claude research model found real flaws in Chrome, Safari, Android, Windows and Linux, then chained them into five working exploits, including a zero-click remote root on Linux servers. The company's Frontier Red Team published the details on Tuesday, October 27, and says every flaw went to the vendor first.

Here's what you need to know:

  • The Chrome chain ran code outside the sandbox from a single page load on stock Chrome for macOS. Google has patched 62 CVEs from Anthropic's reports as of Chrome 156.

  • The Safari chain switched off the same-origin policy, letting any site read data from other sites you're signed in to.

  • The Linux chain gave a remote attacker a root shell, no login needed, on servers with a multipath TCP listener (CVE-2026-98432).

  • The exploits were built in the lab after prompting, not seen in real attacks, and all are already fixed, according to Anthropic.

  • Anthropic hasn't named the model or detailed how much humans did at each step.

UML sequence diagram of Anthropic's Chrome exploit chain: a malicious page corrupts V8 heap memory, a second bug escapes the V8 sandbox and defeats ASLR so a ROP chain controls the renderer, a CacheStorage race condition leaks the browser process memory layout, and a use-after-free in FedCM sign-in runs code outside the sandbox; fixed in Chrome 156

How one page load escaped Chrome's sandbox: the four-bug chain, step by step

What Happened

In a post titled Discovering and exploiting vulnerabilities in critical, real-world software with Claude, Anthropic's Frontier Red Team says it spent "the past few months" pointing an unreleased research model at browsers and operating systems. After "initial prompting", the model found bugs and wrote multi-step exploits.

Here are the five chains:

  • Chrome: four flaws in a row. A V8 heap corruption, a V8 sandbox escape that defeated ASLR, a race condition in CacheStorage, and a use-after-free in FedCM, Chrome's federated sign-in feature. The proof of concept opened Calculator on a Mac within seconds of the page loading. Google's Chrome 156 stable release carries the fixes; Anthropic says all 62 CVEs were rated critical or high, including 13 sandbox escapes.

  • Safari: a data-only attack. A JavaScriptCore use-after-free, a way around WebKit's Gigacage, and a sandbox IPC flaw combined to flip the same-origin policy off. Apple's security advisory has the fix.

  • Android: with physical access over USB, the exploit pulled photos and personal data off a locked Google Pixel 9 by skipping pairing checks. Anthropic says Google has addressed it.

  • Windows: an out-of-bounds read in the kernel's QUIC handling that lets a few packets crash any server answering HTTP/3 with the native Windows stack, tracked as CVE-2026-33096. Anthropic estimates "several million such servers" are on the internet.

  • Linux: a race-induced use-after-free in the kernel networking stack. The attacker leaks a kernel pointer to beat KASLR, then hijacks a callback to run a command as root. The proof of concept took 48 minutes to leak the pointer and five more to get the shell, and lost races don't crash the box, so an attacker can keep retrying.

The Hacker News checked the paper trail. Chrome's release notes credit "Xinyang Ge of Anthropic, assisted by Claude" for some fixes, and Apple credits Anthropic researchers "with Claude" for the Safari bug. But the Windows CVE record names HTTP.sys, rated 7.5, and credits no finder. The Linux CVE-2026-98432 record is rated 9.8 and was fixed upstream on October 15, though THN notes it describes an IPv4 TCP fix, so the multipath TCP link rests on Anthropic's post.

Why It Matters

Chaining several separate bugs into one reliable exploit has long been the work of a handful of elite teams. Anthropic's claim is that a model can now do it "with little human involvement, and then prove by producing a working exploit that anyone can run and verify."

That cuts both ways. Defenders get a much faster bug-hunting engine. Attackers with similar models could find the same classes of bugs before vendors do. The volume alone is striking: 62 critical or high Chrome CVEs from one research effort.

There's also a caveat worth keeping in mind. As The Injection's summary and THN both note, the capability claim rests on Anthropic's own account. The company doesn't break down what a person did at each step, and it doesn't say how many attempts failed.

What It Means for Developers

The patches are out, so the gap now is your update lag. A few concrete steps:

  • Update browsers everywhere, including CI runners, headless test images and kiosks. Make sure Chrome is on 156 or later, and Apple devices are on the release in Apple's advisory.

  • Patch your Linux kernels. CVE-2026-98432 has been backported to all maintained stable branches, Anthropic says. If you don't need multipath TCP, check whether it's enabled on public listeners.

  • Check Windows servers that answer HTTP/3 for the April 2026 fix for CVE-2026-33096.

  • Scan at PR time. Anthropic recommends catching bugs before merge, and says it has publicly released a Claude Code plugin with built-in security guidance.

  • Assume faster exploit timelines. If models can turn bugs into exploits quickly, "patch within the month" may not be fast enough for internet-facing systems.

We've been tracking this shift: see how Tailworm chained Tailscale SSH into root, and how a single compressed response could hijack Node.js and Python apps with HTTP2Shell.

Patch matrix of the five exploit chains: Chrome code execution outside the sandbox fixed in Chrome 156, Safari same-origin bypass fixed in an Apple security update, Android locked-phone data theft over USB fixed by Google, Windows HTTP/3 remote crash fixed as CVE-2026-33096 in April 2026, and Linux zero-click remote root via a multipath TCP listener fixed as CVE-2026-98432 upstream on October 15

Five chains, five fixes: what to update and where

What's Next

Anthropic's disclosure policy gives vendors 90 days to patch, plus 45 more days before it shares details beyond public advisories, so more write-ups could follow. The post also says the team found local privilege escalation bugs in OpenBSD, FreeBSD and Linux, plus sandbox escapes and web app flaws it hasn't detailed yet.

The company is steering security teams to its expanded Cyber Verification Program, which gives vetted professionals access to models including Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1 with reduced blocking classifiers.

The big open questions: which model did this, when (if ever) it ships, and what stops attackers from getting the same capability.

FAQ

Were these exploits used in real attacks?

No. Anthropic says they were built in the lab after prompting and reported to vendors first. THN notes CVE-2026-33096 was marked as not exploited and isn't in CISA's known exploited list.

Which model found the bugs?

Anthropic only calls it "an unreleased, internal research model." It hasn't named it or said when it might be released.

What should I update first?

Internet-facing Linux servers and browsers. Get Chrome to 156 or later, apply Apple's update, and install a kernel with the CVE-2026-98432 fix.

Sources

Follow TheTechLane

Keep learning AI, development, and modern developer technologies with TheTechLane.

Learn • Build • Share

Follow @thetechlanehq for more developer guides, tutorials, and practical technology content.