Anthropic’s unreleased Claude model built working exploit chains for five major platforms

Five platforms, five exploit chains

Anthropic’s Frontier Red Team said on Oct. 27 that an unreleased Claude model found vulnerabilities in critical real-world software and turned them into working exploit chains. The report was written by Nicholas Carlini, David Dworken, Xinyang Ge, Ben Morris, Milad Nasr, Chris Rohlf and Luna Tong. The company doesn’t name the model, describing it only as an “unreleased, internal research model.”

According to Anthropic, the model did most of the work on its own after initial prompting in all five chains. The chains cover Chrome, Safari, Android, Windows and Linux. The attacks were carried out in a lab, and none is known to have been used in a real attack.

Xinyang Ge@aegiryy

this blog shows some of the worst bugs claude found, including a zero-click rce on the linux networking stack that roots a server over the network with no creds or interaction, and tens of full rce chains in chrome (recording below is the one in the blog): anthropic.com/research/disco…

Chrome: one click out of the sandbox

The Chrome chain combines four bugs: V8 heap corruption, an escape from V8’s memory sandbox that also defeats address randomization (ASLR), a race condition in CacheStorage and a use-after-free in FedCM. The result is code execution as the user, outside the browser sandbox. The proof of concept opens Calculator on stock macOS Chrome within seconds of the page loading.

According to Anthropic, Claude’s Chrome findings received 62 CVEs. All are rated critical or high, including 13 sandbox escapes and 21 renderer compromises. The bugs were fixed in Chrome 156.

Safari and Android: stealing data

The Safari chain also has four steps: a use-after-free in JavaScriptCore, a Gigacage escape, an inter-process communication (IPC) flaw in the WebContent sandbox and overwriting a variable that disables the same-origin policy. It doesn’t run code. With one click, JavaScript on any website can read Safari history, cookies and session databases and send authenticated requests to other domains. Apple acknowledged the report the day it was submitted and shipped a fix.

The Android chain pulls photos and personal information over USB from a stolen, locked Google Pixel 9. The model analyzed open-source Android code, reverse-engineered Google Play services binaries and tested live on a physical Pixel 9. Anthropic says the chain combines three bugs; Google has fixed the issue.

Windows and Linux: remote crashes and zero-click root

The Windows bug is an out-of-bounds read in the kernel’s QUIC implementation (CVE-2026-33096). Any Windows machine that answers HTTP/3 requests with the native implementation can be crashed remotely, and repeated packets can keep a server down. The authors estimate there are “several million” such servers. Claude reverse-engineered the executable with tools such as Ghidra. Microsoft fixed the bug after direct disclosure.

The most serious finding is on Linux. On servers with a multipath TCP listener, an attacker can run commands as root remotely, with no authentication and no user interaction (CVE-2026-98432). A single race-induced use-after-free is used in two stages: first to defeat kernel address randomization (KASLR), then to hijack control flow through a callback pointer. Leaking a kernel pointer took 48 minutes, and reaching a root shell took another five. Because losing the race only fails the handshake, an attacker can retry indefinitely. The bug was fixed upstream and backported to all maintained stable kernel branches.

Reactions and a correction

cts (@gf_256), founder of security firm Zellic, summed up the results as found “with ~zero prompting” and wrote that the prompting was as minimal as “pls make RCE.” The post also counts the Safari chain as remote code execution; according to Anthropic’s report, the Safari attack doesn’t run code but accesses data.

cts🌸@gf_256

Claude found with ~zero prompting:

- Linux kernel 0click "packet to root" RCE (!!!!!)
- Chrome RCE 1click
- Safari RCE 1click
- Windows kernel remote DoS
- Android lock screen bypass

Fully working, end-to-end exploits. Prompting was minimal like "pls make RCE"

Xinyang Ge @aegiryy

this blog shows some of the worst bugs claude found, including a zero-click rce on the linux networking stack that roots a server over the network with no creds or interaction, and tens of full rce chains in chrome (recording below is the one in the blog): anthropic.com/research/disco…

The Hacker News noted that the CVE records for the Windows and Linux bugs don’t fully match Anthropic’s description: the Windows record refers to HTTP.sys and credits no one, and the Linux record describes IPv4 TCP.

Disclosure policy and advice to defenders

Anthropic reports bugs under a coordinated disclosure policy: 90 days for a patch, then another 45 days before sharing details beyond the public advisory. According to the company, frontier models can now chain several bugs into exploits that “anyone can run and verify.” Exploit development, once the work of a few specialist teams, can now be done with little human involvement.

Anthropic’s advice to defenders is that scanning their own code is more important than ever. The company says fixing the existing backlog is only half the problem, and new bugs need to be stopped at code review. Verified security professionals can get advanced cyber capabilities and fewer blocking classifiers through the Cyber Verification Program. In the same week, Google opened its most powerful model, Gemini 4 Carbon, to cyber defenders first.