AI Vulnerability Discovery: Anthropic's Unreleased Model Chained Flaws in Chrome, Safari, Windows and Linux Into Working Exploits, and What to Patch

Anthropic says one of its unreleased AI models found security flaws in Chrome, Safari, Android, Windows and Linux, then chained them together into working attacks. The company published the research on October 27, 2026. Every flaw went to the vendor first and Anthropic says all of them are fixed. For businesses the message is simple: the patches already exist, and the gap between someone finding a bug and someone having a working exploit is getting shorter.

What Anthropic says its AI model did

Anthropic's Frontier Red Team says the work used "an unreleased, internal research model". Its researchers gave the model "initial prompting" and the model then produced multi-step exploit chains. An exploit chain links several bugs together. Each bug moves the attacker one step further, until the result is serious, such as running code on a computer that only opened a web page.

The five chains, as Anthropic describes them:

• Chrome on macOS: four bugs in sequence, starting in V8 (Chrome's JavaScript engine) and ending with code running outside the browser sandbox. The demo opened Calculator on a default Chrome install "within seconds of the page loading", with no further clicks.
• Safari: a chain that never runs code. It disables the browser rule that keeps websites apart, so any site could read Safari history, cookies and session data, and send signed-in requests to other sites.
• Android: pulls photos and personal data off a stolen phone without unlocking it. It works by getting around the rule that a locked phone should not transfer data to a connected USB host. Anthropic tested this on a Google Pixel 9.
• Windows: a remote crash of any Windows machine that answers HTTP/3 requests through the built-in implementation. Repeating the requests keeps the machine down. Anthropic estimates "several million such servers listening on the internet."
• Linux: remote root commands, with no login, on servers that run a multipath TCP listener. In the demo, leaking a kernel address took 48 minutes and getting command execution took five more. A failed attempt does not crash the server, so an attacker can keep trying.

Anthropic also says it reported 62 Chrome flaws that received CVE IDs and were fixed as of Chrome 156, all rated critical or high.

What is confirmed and what is not

Confirmed in vendor records we opened:

• Google's Chrome 156 desktop update of October 27, 2026 (156.0.8078.73/.74) lists 52 security fixes. Two critical and four high-severity flaws are credited to "Xinyang Ge (Anthropic), assisted by Claude", and two more high-severity flaws to Anthropic and Ada Logics. A later build, 156.0.8078.79/.80, followed on October 29.
• Apple's notes for iOS and iPadOS 26.5.2 (released June 29, 2026) credit a WebKit memory corruption flaw, CVE-2026-43715, to "Milad Nasr and Nicholas Carlini with Claude, Anthropic."
• Microsoft lists CVE-2026-33096 in its April 2026 Security Updates, released April 14, 2026. It is an out-of-bounds read in Windows HTTP.sys that lets an attacker "deny service over a network". It is rated 7.5 and Microsoft assessed it as "Exploitation Less Likely."
• CVE-2026-98432 is a Linux kernel use-after-free, published October 15, 2026 and scored 9.8. Fixed stable kernels are listed below.

Not confirmed, or not known:

• Anthropic does not name the model or describe how much human help it had after the initial prompt.
• The public CVE records describe the bugs differently from Anthropic. The Windows record names HTTP.sys rather than QUIC handling. The Linux record describes an IPv4 TCP fix and does not mention multipath TCP. The link between these CVEs and the chains comes from Anthropic's post.
• Anthropic says Google fixed the Android issue but gives no CVE ID or patch level, so there is no specific Android update to look for.
• Anthropic's post does not list CVE IDs for the Chrome or Safari chains, so we can't map each step of a chain to a specific fix.
• Anthropic built these exploits in a lab. None of the vendor records we checked say the flaws were used in real attacks.

What to patch this week

How to check your systems

• Confirm every managed Chrome install is on 156.0.8078.79 or later, and that nobody has paused updates.
• Restart browsers. Chrome downloads updates in the background, but the fix only takes effect after a relaunch.
• Check company iPhones and iPads in your device management tool for anything older than 26.5.2.
• On Windows servers, confirm the April 2026 cumulative update or a later one is installed. Find out which servers answer HTTP/3.
• On Linux servers, run sysctl net.mptcp.enabled and ss -Mlnp to see whether multipath TCP is on and listening. Then install your distribution's kernel update and reboot. A kernel update does nothing until the server restarts.
• For lost or stolen Android phones, assume the data could be read and use remote wipe.

We covered the Linux flaw in more detail in Linux Kernel TCP Flaw CVE-2026-98432, and the wider Chrome release in Chrome 156 and Firefox 159 Security Updates.

Why AI-found exploits matter for a business network

The bugs themselves are not the news. Browsers and kernels get flaws like these every month. What changes is how fast the work gets done. A working exploit used to take a skilled team days or weeks. Anthropic says a model can now find bugs and prove they work "with little human involvement". That claim comes from a company selling the technology, so treat it with care. Still, the vendor credits show the bugs were real.

If defenders can do this, attackers can too. We have already written about a group using AI agents in attacks in Vapor Panda ARTEX Attacks. For a company network, this means patching on a fixed schedule matters more than it used to. Exposed services like web servers, VPN gateways and anything reachable from the internet should get fixes in days, not at the next quarterly maintenance window. If urgent fixes in your company wait on approvals, read Patch Management Process: Why Urgent Security Fixes Stall. If you rely on vendors to ship fixes, see Updated Is Not the Same as Patched.

It also matters for your own website and apps. Anthropic's advice to software teams is to scan their own code for flaws and to check new code before it ships, not just after.

AI vulnerability discovery questions people are asking

Did an AI hack Chrome by itself?

Not quite. Anthropic says researchers gave an unreleased model initial prompts, and the model found the bugs and built the exploit chains. Google's release notes credit an Anthropic researcher "assisted by Claude." How much humans helped at each step has not been published.

Are these AI-found vulnerabilities being used in real attacks?

Nothing in the vendor records we checked says so. Anthropic built the exploits in a lab and reported them before going public. Microsoft rated the Windows flaw "Exploitation Less Likely."

If my devices update automatically, am I covered?

Probably, if the update actually installed and the device restarted. Check the version numbers in the table above. Servers and managed laptops are where updates most often stall.

Can attackers use AI to find exploits the same way?

Anthropic's own warning is that frontier models can now find and chain flaws with little human help. Assume attackers will try. The best defense is still fast patching and fewer services exposed to the internet.

Is my Linux server affected by the multipath TCP exploit?

Anthropic says the attack needs a multipath TCP listener. Check with ss -Mlnp. Either way, install the patched kernel, because the CVE record describes the underlying bug in general TCP code.

The bigger lesson

AI is making it faster and cheaper to turn a bug into a working attack. The vendors fixed these flaws, but your systems are only protected once someone installs and restarts. A patch schedule that worked five years ago is too slow now.

Want a second set of eyes on your patching and exposed services? See security hardening or request a quote.

Get security alerts like this by email, with our free checklist, at /security-alerts.

Sources: Anthropic Frontier Red Team; Google Chrome Releases, October 27, 2026; Google Chrome Releases, October 29, 2026; Apple iOS 26.5.2 security content; NVD CVE-2026-33096; NVD CVE-2026-98432.