Anthropic says Claude built five exploit chains across browsers and operating systems

What Anthropic reported

Anthropic's research post [1] describes five attack chains produced after initial prompting of an unreleased internal model. The company says the work covered source review, binary analysis, reverse engineering and tests on real devices.

For Chrome, Anthropic says Claude combined four flaws to run code outside the browser sandbox after a page loaded. It reports 62 assigned CVEs patched by Chrome 156, including 13 sandbox escapes and 21 flaws that could compromise the renderer.[1]

The other demonstrations covered a Safari same-origin-policy bypass, data extraction from a locked Pixel 9, a remote Windows HTTP/3 denial of service and remote root command execution against a Linux multipath TCP listener.[1]

Which facts have public vendor records

NIST's record for CVE-2026-33096 [4] describes an out-of-bounds read in Windows HTTP.sys that lets an unauthenticated network attacker cause denial of service. Microsoft supplied the record, which points to its April 14 security update.

Oracle's Linux advisory for CVE-2026-98432 [5] records the kernel race and lists fixed Oracle Linux packages released on October 16. This corroborates the flaw and available vendor fixes, although Anthropic's post supplies the exploit-chain details.

Apple's linked security bulletin [3] confirms that iOS 26.5.2 and iPadOS 26.5.2 shipped on June 29 with WebKit fixes. The bulletin does not identify which entries make up Anthropic's Safari chain.

Google's Chrome 156 release page [2] is the release record Anthropic cites for the Chrome fixes. Anthropic has not published a mapping from all 62 CVEs to the four-step demonstration.[1][2]

What defenders should check now

• Confirm every managed Chrome installation runs version 156 or a later supported release. Use fleet inventory or browser-management reports rather than relying on automatic-update policy alone.
• Install the latest supported Safari, macOS, iOS and iPadOS updates. Record devices that cannot receive current security releases and isolate or replace them based on exposure.
• Confirm April 2026 or later Windows cumulative updates cover CVE-2026-33096 on systems that expose native HTTP/3 services. Check the installed update and service exposure separately.
• Ask each Linux distribution which kernel package fixes CVE-2026-98432. Prioritize internet-facing systems with multipath TCP enabled or listening, then verify the running kernel after reboot.
• Keep exploit code out of routine production validation. Use package versions, vendor advisory status and controlled scanners as evidence that remediation is complete.
• Watch for later CVE mappings and exploitation reports. Reassess priority if a vendor expands the affected-version range or a trusted incident source reports abuse in the field.

Why the research matters for AI security teams

The demonstrations cover more than single-bug discovery. According to Anthropic, the model linked weaknesses across browser engines, sandboxes, inter-process communication, kernel networking and device-transfer protocols.[1]

Security teams should evaluate AI vulnerability tools on verified findings, reproducible impact, disclosure quality and patch outcomes. A large scan count by itself does not show that the reports are distinct, exploitable or useful to maintainers.

Teams also need controls around access to offensive models. Separate research networks, scoped targets, review gates and coordinated disclosure reduce the chance that an automated scanner reaches systems outside its authorization.

What remains uncertain

• Anthropic has not named the internal model version or published enough information for outside teams to reproduce its capability claims.[1]
• The public Chrome release record does not map all 62 CVEs to the demonstration, so that count remains Anthropic's aggregate claim.[1][2]
• Anthropic did not provide public CVE identifiers for the Safari or Android chains in the research post.[1]
• No source cited here reports exploitation of these five chains against users in the field.
• Patch availability does not prove that managed fleets have installed the fixed releases.
• The independent analysis summarizes the report and patch status, but it does not independently reproduce the exploits.[6]

Frequently asked questions

• Did Claude attack real users? Anthropic describes controlled research followed by coordinated disclosure. It does not report attacks on users with these chains.[1]
• Are all 62 Chrome CVEs part of one exploit? No. Anthropic describes one four-step Chrome chain and a wider set of 62 assigned findings.[1]
• Is CVE-2026-33096 remote code execution? No. NIST describes a network-reachable denial of service in Windows HTTP.sys.[4]
• Does every Linux server face the demonstrated root attack? Anthropic's chain requires a multipath TCP listener. Administrators still need their distribution's affected-version and fixed-package guidance.[1][5]
• Should teams wait for more technical detail? No. Vendor patches are already available, and patch verification does not require the withheld exploit details.[2][3][4][5]
• What would change this assessment? Public CVE mappings for the browser and Android findings, independent reproduction, affected-version details or evidence of exploitation would make the risk boundary more precise.