Claude chained bugs into a one-click Chrome takeover, Anthropic says

Anthropic says an unreleased internal research model found critical flaws in browsers and operating systems and chained them into working attacks. In a post published October 27, the company describes five chains. The Chrome work alone has produced 62 CVEs, patched as of Chrome 156.

Five attack chains, from Chrome to the Linux kernel

Anthropic says each exploit began with an initial prompt, after which Claude wrote the code itself. The first target was Chrome. According to the company, the model found a bug in the V8 JavaScript engine, a second one to escape V8’s memory sandbox and defeat ASLR, a race condition in CacheStorage, and a use-after-free in the FedCM sign-in feature. Together they let a web page run code outside the browser sandbox. The proof of concept opens the Calculator app on macOS within seconds of a page loading. Of the 62 Chrome CVEs, all rated critical or high, 13 are sandbox escapes and 21 could compromise the renderer.

The Safari chain is a data-only attack. It never runs arbitrary code. Instead it uses read and write access to memory to change a security flag, an object size and a URL, which switches off the same-origin policy. A page could then read a user’s history and cookies and send authenticated requests to other sites. Apple acknowledged the report the same day, and the fix is available to users, Anthropic says.

On Android, Claude chained three vulnerabilities to pull photos and personal data from a locked Pixel 9 over USB. It got past four protections: the USB data block, an authorization check, a six-digit pairing confirmation and a hardcoded ban on file contents. Google has addressed the issue.

The Windows case is a denial of service. A kernel out-of-bounds read in the QUIC implementation, tracked as CVE-2026-33096, lets a few packets crash and restart any machine answering HTTP/3 requests with the native stack. Anthropic estimates several million such servers face the internet. The model found it by reverse-engineering a Windows binary with tools such as Ghidra, then rebuilding the logic as an annotated C program.

The Linux chain targets servers with a multipath TCP listener. Per Anthropic, it needs no credentials and no user action, and it ends with commands running as root. Leaking a kernel pointer took 48 minutes in the proof of concept, plus five more minutes to reach code execution. A lost race only fails the handshake rather than crashing the system, so an attacker can keep retrying. The flaw, CVE-2026-98432, is patched upstream and in all maintained stable branches.

How this compares with Anthropic’s earlier cyber claims

The post does not name the model or give detection benchmarks, so context has to come from earlier coverage. According to reports on Project Glasswing, Anthropic launched that restricted program on April 7, 2026 around Claude Mythos Preview, and said it would not release that model generally. VentureBeat’s coverage of the launch cited a CyberGym score of 83.1% for Mythos Preview against 66.6% for Claude Opus 4.6. Those figures were reported by outlets and are not repeated on this new page.

What is new here is the kind of evidence. The earlier claims were mostly counts of bugs found. This post shows end-to-end exploits against some of the hardest-to-attack products, with specifics: 62 browser CVEs, a remote root path on Linux that takes under an hour in the proof of concept, and a lock screen bypass on current hardware. The authors also stress that several Safari weaknesses were intended behaviors that only became exploitable in combination, which is the kind of reasoning that single-function scanners tend to miss.

What defenders can use today, and what is unproven

The research model itself is not available. Anthropic says it has released an expanded Cyber Verification Program, which gives qualifying security professionals access to advanced cyber capabilities with reduced blocking classifiers. The program covers Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1, plus new models going forward. It also published a Claude Code plugin that builds security guidance into development, and recommends scanning at pull-request time to slow the arrival of new bugs.

Its operational advice is to run many scanning agents in parallel with different strategies, from pure coverage to threat-model checks, and then pass every result through a standard verification and risk-rating step. The company reports that this scaling of compute and variety raises the number of bugs found.

Several things remain unestablished. The vendors’ own advisories are the only independent check, and the post does not say how many attempts failed, how much human steering the “initial prompting” involved, or what the runs cost. Only the Chrome count and the two CVE numbers are given; Safari and Android carry no public identifiers in the text. Disclosure also follows Anthropic’s schedule: 90 days for vendors to patch, then 45 more before it discusses details beyond public advisories, so deeper technical write-ups may come later.