Claude Autonomously Discovers Critical Vulnerabilities and Builds Exploit Chains Across Major OSes
Anthropic released a research report demonstrating that an internal Claude model autonomously discovered critical vulnerabilities in Chrome, Safari, Android, Windows, and Linux. The model not only identified flaws but also wrote exploit code and constructed five functional attack chains, including zero-click root access on Linux and sandbox escapes in browsers. All reported vulnerabilities have been patched via coordinated disclosure.
Full Report
IT Home reported on October 29 that Anthropic published a research report on October 27, stating that it discovered vulnerabilities in Chrome, Safari, Android, Windows, and Linux using an unpublished internal Claude research model. The team chained multiple vulnerabilities into five functional attack chains. All related vulnerabilities have been reported to vendors through coordinated disclosure processes and patched.
Chrome drew the most attention. Citing the blog post, IT Home noted that Anthropic’s report to Google resulted in 62 critical or high-severity CVEs, including 13 sandbox escape vulnerabilities and 21 vulnerabilities allowing control of the web rendering process. Fixes were released with Chrome 156.
The research team stated that after receiving initial prompts from researchers, Claude autonomously located vulnerabilities and wrote exploit code. Its Chrome proof-of-concept could launch the Calculator app within seconds of page load on a default macOS installation.
Regarding Safari, the vulnerability chain discovered by Claude could bypass the Same-Origin Policy, allowing malicious websites to potentially access data from users’ logged-in accounts. Apple confirmed and released fixes on the same day. The Android attack required physical access to the device; it could extract personal data such as photos via USB while a Pixel 9 was locked. Google stated that the issue has been addressed.
For Windows, Claude focused on a vulnerability tracked as CVE-2026-33096, rated 7.5. Attackers could crash servers responding to HTTP/3 requests without authentication or user interaction. Microsoft released a patch in April 2026.
The most severe was the Linux vulnerability CVE-2026-98432, targeting servers running multipath TCP listeners. An attacker could gain a root shell without credentials simply by sending packets. Anthropic’s verification took 53 minutes in total: 48 minutes to leak kernel pointers and 5 minutes to execute commands.
Anthropic disclosed five attack chains that chained together multiple vulnerabilities, configuration weaknesses, or race conditions to achieve outcomes such as data theft, system crashes, or remote control:
1. Chrome: Bypassing the Sandbox to Execute Code
The attack begins with a vulnerability in the V8 JavaScript engine, followed by bypassing Chrome’s memory sandbox. It then exploits a CacheStorage race condition and a use-after-free flaw in FedCM to ultimately execute arbitrary code outside the sandbox.
2. Safari: Stealing Sensitive Data with One Click
The model constructed a "one-click" attack chain that bypasses the Same-Origin Policy, allowing a malicious webpage to access data from other websites that should be isolated. This enables reading browser history, cookies, and sensitive information such as emails and banking details when logged in.
3. Android: Extracting Photos from Locked Phones
This chain targets locked or unlocked Pixel 9 Android phones, exploiting USB-related flaws to extract personal information like photos even when the device is not unlocked. Phones may leak local media and personal profiles even in a locked state.
4. Windows: Remotely Crashing Servers Repeatedly
Claude discovered an out-of-bounds read vulnerability in the Windows QUIC kernel implementation, which can remotely trigger repeated server crashes.
5. Linux: Gaining Root Privileges with Zero Clicks
The research team stated that Claude found a zero-click remote code execution vulnerability in the Linux kernel network stack, capable of gaining root privileges in approximately 53 minutes.
