An unreleased Claude built working exploits for Chrome, Safari and Linux. What to update

What Anthropic says Claude did

On October 27, 2026, Anthropic’s Frontier Red Team published five attack chains written by “an unreleased, internal research model.” An attack chain strings several flaws together, each one getting past a layer of protection, until the attacker has what they came for: their code running on your computer, your data, or your server down. Each of the five starts the same way in Anthropic’s telling: “After initial prompting, Claude wrote” the exploit.

Anthropic reported every flaw under its coordinated disclosure policy, “which gives developers 90 days to patch and a further 45 days before we discuss details beyond what is already included in a public advisory.” So each chain was fixed before it was described. The Hacker News sums it up: the exploits “were built in the lab after the model was prompted, not seen in any real attack.”

What’s new is who can do this work. Anthropic says these skills “have historically been the domain of few specialist teams with expertise in these targets.” And: “Now, it’s something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify.”

The five chains, and where each was fixed

Target	What the exploit did	What it needed	Fixed in
Chrome	Ran the attacker’s code outside Chrome’s sandbox	Opening a web page	Chrome 156, October 20
Safari	Let any website read other sites’ data, signed-in email included	Opening a web page	iOS, iPadOS, macOS Tahoe and Safari 26.5.2, June 29
Android	Copied photos and personal data off a locked Pixel 9	The phone, over USB	“Addressed by Google,” no version given
Windows	Crashed the machine with a few packets, again and again	A server answering HTTP/3	April 2026 updates, CVE-2026-33096
Linux	Ran commands as root, with no login	A server with a multipath TCP listener	Stable kernels, CVE-2026-98432

Chrome. Four flaws in a row: one in V8, Chrome’s JavaScript engine, that let a page corrupt memory; a second to escape V8’s sandbox; a race condition in CacheStorage that revealed the layout of Chrome’s privileged browser process; and a use-after-free in FedCM, Chrome’s federated sign-in feature, to run code outside the sandbox. The proof of concept “launches the Calculator app from a stock default-configuration Chrome browser on macOS within seconds of the page loading, without any further user interaction.” Anthropic says Google assigned 62 CVEs to its reports, all critical or high and “patched as of Chrome 156,” including 13 sandbox escapes. Chrome 156’s release notes, from October 20, credit 15 of its fixes to Xinyang Ge, one of the post’s authors, five of them “(Anthropic), assisted by Claude.” Four more in the same release are credited to OpenAI Codex Security.

Safari. A use-after-free in JavaScriptCore, Safari’s JavaScript engine, a way out of WebKit’s Gigacage, and a flaw in the WebContent sandbox let the exploit read Safari’s history, cookies and session databases, then switch off the same-origin policy, the rule that keeps one site from reading another’s data. Anthropic’s example: “if the user is signed in to their email account, the attacker can now read their email.” It never ran code of its own; Anthropic calls it “a data-only attack.” Apple fixed it on June 29, 2026, in iOS and iPadOS 26.5.2, macOS Tahoe 26.5.2 and Safari 26.5.2 for macOS Sonoma and Sequoia, each crediting a WebKit use-after-free, CVE-2026-43715, to “Milad Nasr and Nicholas Carlini with Claude, Anthropic.”

Android. Testing on a physical Pixel 9, the model found that a USB host with a specific setting got a locked phone to transfer data, skipped the pairing authorization check, skipped the six-digit code check so the phone “behaved as if the user had tapped ‘Allow,’” and pulled file contents through a fallback that a hardcoded check didn’t cover. Anthropic says only: “This issue has been addressed by Google.” It gives no update or patch level, and The Hacker News found no public record of the fix.

Windows. An out-of-bounds read in the Windows kernel’s QUIC code, the transport under HTTP/3. An attacker could “send a few packets of data to a listening server to crash and restart the machine,” and keep doing it. Anthropic estimates “there are likely several million such servers listening on the internet.” Claude found it by reverse-engineering the Windows binary with tools such as Ghidra, and Microsoft fixed it as CVE-2026-33096.

Linux. The exploit lets a remote attacker “send packets to Linux servers with a multipath TCP listener to run arbitrary commands as root, without any credentials or user interaction.” A lost race “only fails the handshake without crashing the whole system,” so an attacker can retry until it works. Anthropic’s proof of concept took 48 minutes to leak a kernel pointer and five more to run its command as root.

What to update

1. Chrome: 156 or newer. Open Chrome’s menu, choose Help, then About Google Chrome, and relaunch when it asks. The current desktop release, from October 27, is 156.0.8078.73 on Linux and 156.0.8078.73 or .74 on Windows and Mac. Chrome for Android carries the same security fixes as the desktop release it matches.
2. iPhone and iPad: iOS or iPadOS 26.5.2 or newer, from Settings, General, Software Update. Apple’s current releases, iOS 27.2 and 26.7.2 from October 26, are newer still.
3. Mac: macOS Tahoe 26.5.2 or newer, or Safari 26.5.2 or newer on macOS Sonoma and Sequoia.
4. Android: install the newest security update your phone offers. No one has said which one carries the fix.
5. Windows: April 2026’s updates or later. The CVE-2026-33096 record lists Windows 11 23H2, 24H2, 25H2 and 26H1, and Windows Server 2022, 2022 23H2 and 2025. Windows 11 24H2 is fixed from build 10.0.26100.8246, and Windows Server 2025 from 10.0.26100.32690. Microsoft rates it 7.5 out of 10, high.
6. Linux servers: a kernel with the fix. The CVE-2026-98432 record marks kernels from 4.4 on as affected and lists the first fixed release in each stable branch: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10, and every release from 7.3. Run uname -r to see yours. Distributions backport fixes under their own version numbers, so check your distribution’s advisory for the CVE, and reboot into the new kernel. The kernel’s own rating is 9.8 out of 10, critical.

Desktop apps built on Electron carry their own copy of Chromium and update on their own schedule, separately from Chrome. Electron 45.0.0, released October 21, moved to Chromium 156.0.8078.48. Electron 44.10.0, from October 27, is on Chromium 152.0.7977.169, and its notes list no fixes from Chrome 156. Update the desktop apps you use, coding agents’ apps among them, when they offer it.

The records don’t quite match Anthropic’s descriptions

Two public CVE records describe the bugs differently than Anthropic does, a gap The Hacker News pointed out:

• Windows. Anthropic describes an out-of-bounds read “in the Windows kernel’s implementation of QUIC.” The CVE-2026-33096 record is titled “HTTP.sys Denial of Service Vulnerability,” describes an “out-of-bounds read in Windows HTTP.sys,” and credits no finder.
• Linux. Anthropic describes a race in the kernel networking stack reached through a multipath TCP listener. The CVE-2026-98432 record is titled “ipv4: free inet_opt and ireq_opt after an RCU grace period” and describes a use-after-free while the kernel’s IPv4 TCP code sends a reply during connection setup. It adds that “IPv6 is not affected by the first issue.” Anthropic’s post is what ties the two together.

Neither difference changes what to do. Both fixes are out, and both records rate the bugs high or critical.

Which model was it, and can you use it?

Anthropic doesn’t say. It gives the model no name and no release date, and doesn’t say how much a person did beyond “initial prompting” or how much compute the work used.

Its registration statement, the filing for its IPO, says Anthropic “recently chose to delay pre-training a new frontier base model for more than a month” for security work, and that “future Anthropic models exhibiting such capabilities may be subject to access constraints,” meaning advanced capabilities in finding cyber vulnerabilities. Neither the filing nor the post ties that model to this one. Our memo on the filing has the rest. Google is gating its newest model the same way: Gemini 4 Carbon goes to cyber defenders first.

What you can use today:

• Claude Opus 5.5, Sonnet 5.5 and Fable 5.1, the generally available models. They “have conservative cyber safeguards that block most cyber work,” Anthropic says, but “can continue to be used for tasks such as code review, patching known issues, vulnerability finding in owned source code, and triage of security alerts.”
• The Cyber Verification Program, which relaxes those safeguards for vetted security professionals and includes Claude Mythos 5.1. Defense Access is for defensive work, and Anthropic aims to answer “within a few days.” Red Team Access is for organizations only and takes “a few weeks.”
• Claude Security, in public beta for Claude Enterprise, which scans connected repositories with Claude Mythos and suggests patches, “with no Cyber Verification Program access required.”
• OSS Scanner, launched October 8, which gives open-source projects free scans by “our strongest models (including Claude Mythos).” Its reports aren’t reviewed by people, so some may be wrong.

Scan your own code

Anthropic’s advice to defenders: “scanning your own code is more important than ever.” Fixing old bugs, it adds, “only solves half the problem”; the other half is stopping new ones, so it scans “at PR time” and has released the Claude Code plugin it uses for that, security-guidance. In Claude Code:

/plugin install security-guidance@claude-plugins-official

It needs Claude Code 2.1.144 or later and Python 3.8 or later, and works in three layers:

1. Pattern warnings as Claude edits, for about 25 dangerous patterns such as pickle.load on untrusted data or raw innerHTML.
2. A review of the diff when Claude finishes a turn, on the newest Opus by default, which sends high-severity findings back to Claude “so it can fix them before you see the response.”
3. A review on git commit that reads related files to catch problems that span several, such as an auth bypass.

The reviews send the changed code, and any files the reviewer reads, to the model endpoint your Claude Code uses, on your Claude Code sign-in, an API key or your cloud provider. SECURITY_GUIDANCE_DISABLE=1 turns the plugin off, and ENABLE_COMMIT_REVIEW=0 turns off just the commit review.

For a sweep of everything, not just each change, an agent can work on a schedule. Enjoy runs Claude Code beside Codex and the other labs’ agents, each on the plan you already have, and a scheduled workflow can have one of them review the week’s changes for security problems every Friday night, on your own computer. Enjoy runs scheduled work only while the computer is awake and Enjoy is open. It’s a monthly subscription, with the first seven days free (pricing). Our guide to running Claude Code on a schedule compares the other ways, Anthropic’s own included.

What Anthropic hasn’t said

• The model’s name, and whether or when it will be released.
• How much people did at each step beyond “initial prompting,” and what the work cost.
• Which Android update fixed the Pixel chain.
• Which Chrome releases carried the rest of the 62 CVEs. Chrome 156’s notes credit 15 fixes to Anthropic’s researcher.
• Why the public records describe the Windows and Linux bugs differently from its post.

We’ll update this memo if Anthropic names the model or Google publishes the Android fix.