Anthropic published five attack chains on October 27, 2026 that it says an unreleased internal research model found and exploited in Chrome, Safari, Android, Windows and Linux. In its words, the model found “critical vulnerabilities in some of the world’s most widely used software”, and the chains “led to remote code execution and other critical impacts with little to no user interaction.”
Everything was reported under coordinated disclosure: vendors get 90 days to patch, plus 45 more before Anthropic discusses detail beyond a public advisory. The fixes are out. This page is read from Anthropic’s post, published at 18:15 UTC.
Anthropic says an unreleased internal research model found and exploited critical vulnerabilities in Chrome, Safari, Android, Windows and Linux, and published five attack chains on October 27, 2026.
Chrome alone: 62 CVEs assigned and patched as of Chrome 156, all rated critical or high, including 13 sandbox escapes.
The Chrome chain ran four discovered bugs together to launch an app on stock macOS Chrome seconds after a page loaded, with no further clicks.
The Linux chain was zero-click root over the network: 48 minutes to leak a kernel pointer, five more to a root shell. Patched as CVE-2026-98432.
Anthropic’s conclusion for defenders: chaining exploits used to need specialist teams, models can now do it with little human involvement, so scan your own code first.
§ 01The five chains
| Target | What the chain does | Status |
|---|---|---|
| Chrome | Four bugs chained to run code outside the sandbox; a stock macOS Chrome launches Calculator seconds after loading a page, no further clicks | 62 CVEs assigned, patched as of Chrome 156 |
| Safari | Any site’s JavaScript bypasses the same-origin policy and reads history, cookies and other origins’ responses | Apple acknowledged the same day; fix shipped |
| Android | Pulls photos and personal data off a locked phone over USB, tested on a Pixel 9 | Addressed by Google |
| Windows | Remotely crashes any machine serving HTTP/3 on the native stack, repeatedly | CVE-2026-33096, resolved |
| Linux | Zero-click root over the network via a race in the multipath TCP path | CVE-2026-98432, patched upstream |
The Chrome numbers are the headline: 62 CVEs, “all of them rated critical or high severity. Among them are 13 sandbox escapes and 21 vulnerabilities that could have been used to compromise the renderer.”
§ 02Why chaining is the part that matters
Finding one memory bug is routine work. The Chrome chain stacked four separate discoveries: corrupt V8’s heap, break out of V8’s memory sandbox and defeat ASLR, win a race in CacheStorage to learn the browser process’s memory layout, then a use-after-free in FedCM to execute code outside the sandbox.
The Safari chain is stranger and arguably more interesting. It never executes attacker code at all. Anthropic calls it “a data-only attack”, using read and write access to the browser’s memory to flip a security flag, change an object size and change a URL. Its note on how the pieces fit: “Several of the weaknesses are not vulnerabilities on their own but intended behaviors that become exploitable when combined.”
The Linux one is the most alarming to operate against, because it needs nothing from the victim. In Anthropic’s proof of concept the attack takes 48 minutes to leak a kernel pointer and another five to run a shell command as root, and a lost race just fails the handshake instead of crashing the machine, so an attacker can retry forever.
§ 03How Anthropic ran it
Two method notes in the post are worth more than the exploits to anyone building security tooling.
- Many scanners, measured against each other. Anthropic built a platform that runs scanning agents in parallel, scores each by how many extra vulnerabilities it contributes, and tracks coverage so the whole codebase gets processed. The strategies range from “is there a vulnerability in this function?” to “does anything in this app bypass its documented threat model?”
- Reverse engineering from a binary. For the Windows bug, Anthropic handed the model the executable and had it drive Ghidra, write an annotated C program reproducing the behaviour, check the reproduction against the binary, then hunt for bugs in its own reconstruction.
On prevention, its line is that a backlog is only half the problem: “the other half is cutting the rate at which new vulnerabilities enter the codebase”, which it recommends doing by scanning at pull-request time, with a Claude Code plugin it has released publicly.
§ 04What it means if you run agents
Anthropic’s own framing: “Frontier models have the ability to discover and combine multiple vulnerabilities into a working exploit. These skills have historically been the domain of few specialist teams.” Its advice is one line, “scanning your own code is more important than ever”, and its Cyber Verification Program is how vetted defenders get the stronger models.
Read with the Mythos 5 incident, the pattern for anyone deploying agents is the same one we keep arriving at: the boundary has to sit outside the model. An agent gets the access its job needs and nothing more, and every command it sends into your systems is classified and gated before it runs, not judged by what the model says it intends to do.
§ 05What to watch
- The 45-day window. Anthropic says it will discuss details beyond the public advisories once it closes.
- Whether the model ships. It is unreleased and internal today; the Cyber Verification Program is the route that would widen access.
- Attackers running the same play. The same scanning-in-parallel method works for anyone with model access and a target.
Q1Which model found these?
An unreleased, internal research model, in Anthropic’s words. The post does not name a public Claude version as the one that produced the chains.
Q2How many Chrome vulnerabilities were there?
62 CVEs assigned and patched as of Chrome 156, all critical or high severity, including 13 sandbox escapes and 21 that could have compromised the renderer.
Q3What is the Safari chain, in plain terms?
Any site’s JavaScript could bypass the same-origin policy, reach Safari history, cookies and session data, and send authenticated requests to other domains. Anthropic calls it a data-only attack that never runs attacker code.
Q4How long does the Linux exploit take?
In Anthropic’s proof of concept, 48 minutes to leak a kernel pointer and five more minutes to reach a root shell, with no credentials or user interaction.
Q5What does Anthropic tell defenders to do?
Scan your own code, and scan at pull-request time rather than only clearing a backlog. It released a Claude Code plugin with its security guidance, and its Cyber Verification Program gives vetted professionals access to its stronger cyber models.