Anthropic says unreleased Claude built working Chrome and Safari exploits

Anthropic says an unreleased internal Claude model found software flaws in Google Chrome, Apple Safari, Android, Windows and the Linux kernel and linked them into working attack chains, according to a research report described by Business Standard on 29 October 2026. The most striking example is a Chrome chain on macOS that, by Anthropic’s account, starts with a malicious webpage and ends with code running outside the browser’s sandbox, with no further action from the user.

The company documented five attack chains, with potential consequences ranging from reading sensitive browser data to running unauthorised code on a system. Anthropic says the vulnerabilities were reported to the affected vendors and that fixes have been issued for several of them.

What Anthropic says the unreleased Claude model did

The report’s central claim is a step change in kind, not only in volume. Business Standard frames it as AI models moving beyond identifying individual software vulnerabilities to linking multiple flaws and turning them into working exploits. Two terms matter here:

• Exploit: code or a technique that takes advantage of a vulnerability.
• Attack chain: several weaknesses linked so that one step enables the next. A flaw might let code run inside a browser while the browser’s sandbox (an isolation layer) blocks access to the rest of the system; a second weakness may bypass that boundary, making the combined attack more serious.

According to Anthropic, Claude developed multi-step exploits against both open-source and proprietary software, and some of them needed little or no further user interaction after the initial trigger. The model could investigate a target, test approaches and produce a proof of concept, a working demonstration that the attack is real.

Anthropic does not name the model in the coverage, and the sources give no release date, benchmark scores or access details for it. For builders, that means there is nothing to call through an API today. This is a capability report, not a product launch.

The five attack chains across Chrome, Safari, Android, Windows and Linux

The table summarises the five examples as Business Standard reports Anthropic’s descriptions. All impact claims are Anthropic’s.

Target	What the chain does (per Anthropic)	Fix status (per Anthropic)
Google Chrome on macOS	V8 memory corruption from a webpage, then sandbox escape; launched Calculator with no further interaction	62 CVEs assigned; patched as of Chrome 156
Apple Safari	Bypasses the same-origin policy; reads history, cookies and stored data; makes authenticated requests	Apple acknowledged and implemented a fix
Android (Pixel 9 tests)	Lock-screen bypass that extracts photos and personal data from a locked phone	Google has addressed the issue
Windows	QUIC protocol flaw that crashes a machine processing certain HTTP/3 requests	Fixed; CVE-2026-33096
Linux kernel	Race condition combined with other flaws to reach root, with no credentials or user action	Patched; CVE-2026-98432, fixes in maintained versions

All rows:

Chrome: from a webpage to outside the sandbox

Anthropic says the Chrome chain begins with a flaw in V8, Chrome’s JavaScript engine, which could let a malicious webpage corrupt memory. The model then identified further weaknesses that helped it move beyond the affected memory area, defeat protections and escape the browser’s sandbox. Its proof of concept could launch the Calculator app from a standard Chrome setup once a webpage loaded, with no further user interaction. Opening Calculator is a conventional, harmless way to show that arbitrary code can run.

The scale of the Chrome work is the clearest number in the report. Anthropic says Google assigned 62 CVE identifiers to the reported Chrome findings and patched them as of Chrome 156. A CVE is a tracking identifier for a recognised vulnerability. Of the group, 13 were sandbox escapes and 21 were flaws that could be used to compromise the browser’s renderer process, the part that handles web content, according to the company.

Safari: reading other sites’ data

In Safari, Anthropic says Claude built a chain that could bypass the same-origin policy, the rule that stops one website from reading another site’s sensitive data. According to Anthropic, the exploit could access browsing history, cookies and other stored information, and make authenticated requests to other websites, meaning actions that use the victim’s logged-in sessions. Apple acknowledged the report and implemented a fix, Anthropic said.

Android, Windows and Linux

The Android example is a lock-screen bypass. Claude combined weaknesses in open-source Android components and proprietary Google Play services, using code analysis, reverse engineering and tests on a Pixel 9, Anthropic said. The chain could let someone holding a stolen, locked phone extract photos and other personal information without unlocking it; Google has addressed the issue, according to Anthropic.

On Windows, the model found a flaw in the QUIC network protocol that an attacker could use to crash a machine when it processes certain HTTP/3 requests; Microsoft fixed it and assigned CVE-2026-33096. On Linux, Claude found a race condition, a bug where operations happen in an unsafe order or at the wrong time, which Anthropic says could be combined with other weaknesses to run commands with root privileges, the highest level of access, without login credentials or any user action. That flaw, CVE-2026-98432, was patched in the Linux kernel with fixes added to maintained versions.

What is new compared with earlier Claude security results

Anthropic’s models have produced security findings before. In May, MindStudio reported that Mozilla shipped Firefox v150 with fixes for 271 vulnerabilities identified by Claude Mythos in a single release cycle, compared with 22 security-sensitive bugs, 14 of them high severity, that Claude Opus 4.6 surfaced in Firefox v148. MindStudio also cites a cybersecurity benchmark figure of 83.1% for Mythos against 66.6% for Opus 4.6; that is MindStudio’s reporting, and the source does not name the specific benchmark.

The difference in the new report is the endpoint. The Firefox work, as MindStudio describes it, was a research loop of reading code, forming a hypothesis, testing, reproducing and explaining individual bugs. The new report, as Business Standard describes it, shows a model going from finding a flaw to demonstrating how it could be exploited, including chains that cross security boundaries. The sources do not say whether the unreleased model is related to Mythos, so no link between the two should be assumed.

What it means for developers and security teams

Business Standard lays out both sides. AI-assisted vulnerability research can help developers find problems before attackers do: models can examine code, explore execution paths and help produce proof-of-concept exploits, which lets teams assess how serious a weakness is and how urgently it needs fixing. The same capability could also reduce the time and expertise involved, which raises concerns about potential misuse.

Practical takeaways for teams that ship software:

• Patch cadence matters more. Several of these chains end at fixed versions, for example Chrome 156 for the Chrome findings. Products that embed browser engines or depend on these platforms inherit the fix only when they update.
• Single bugs are not the whole risk. Business Standard notes that impact depends on the software and on whether a chain works reliably, and that one flaw can help an attacker cross a security boundary or gain greater access. Defence in depth assumes layers hold independently; chaining is exactly how layers are defeated.
• “Hardened” is a moving target. MindStudio’s argument after the Firefox result was that assumptions about what counts as hardened may not survive the jump between model generations.

For context on how other labs are handling this, Moonshot recently shipped a model with its offensive security abilities deliberately limited, covered in Moonshot launches Kimi K3.1 Pro with hacking skills deliberately curbed.

Limits, risks and open questions

The evidence has clear boundaries. Everything about the model’s behaviour comes from Anthropic’s own report, relayed by Business Standard. The coverage does not describe how much human guidance the model received, how many attempts each chain took, or how reliable the exploits are. Vendor responses, including CVE numbers and patch versions, are reported through Anthropic’s account.

Anthropic’s warning goes beyond today’s bugs. Business Standard reports that the company warns advances in AI could enable self-replicating malware to spread across connected devices. The report does not, in the coverage available, say how Anthropic plans to control access to a model with these abilities.

Anthropic’s own AI products are also not immune to security problems. In July, CSO Online reported that Manifold Security found two vulnerabilities in Anthropic’s Claude for Chrome extension that remained exploitable months after being reported. According to the researchers, one flaw could let another browser extension send synthetic clicks that Claude accepted as real user approvals, and, with the “Act without asking” mode enabled, retrieve Gmail, Google Docs or Calendar content. That case is separate from the new research, but it is a reminder for builders that AI agents with browser privileges add their own attack surface.

What to watch next

• Release decisions. Whether Anthropic names the model, publishes access rules or keeps it internal. The sources give no plan.
• Remaining fixes. Anthropic says fixes have been issued for several of the reported flaws; watch for vendor advisories confirming the rest.
• Independent replication. Third-party researchers testing similar AI-driven exploit chaining would turn a maker’s claim into independent evidence.
• Policy response. Anthropic is already under scrutiny in Washington, as covered in Trump orders US agencies off Anthropic as Pentagon labels it a risk. A report showing offensive cyber capability is likely to feature in that debate.