Anthropic Reports Five Claude-Found Exploit Chains

Anthropic says an unreleased internal research model, Claude, found critical vulnerabilities in widely used browsers, operating systems and other software over the past few months. The company describes five attack chains that led to remote code execution or other critical impacts with little to no user interaction; vulnerabilities in the affected products could put billions of users at risk. Anthropic says it reported each finding to the relevant vendor under coordinated vulnerability disclosure, which allows 90 days for patching and a further 45 days before discussion beyond public advisories.

In Chrome, Claude combined vulnerabilities in V8, the browser’s JavaScript engine, CacheStorage and FedCM to escape security boundaries and run code as the user. Anthropic says its proof of concept opened Calculator from a default Chrome browser on macOS within seconds of a page loading, without further user interaction. Google assigned and patched 62 CVEs as of Chrome 156; all were rated critical or high severity, including 13 sandbox escapes and 21 flaws that could compromise the renderer process.

For Safari, Claude chained flaws to bypass the same-origin policy, which normally restricts a website from reading data from other sites. The exploit could access browsing history, cookies and session databases, and send authenticated requests to other domains. It used memory read/write access to change a security flag, object size and URL, without arbitrary code execution. Apple acknowledged the report the day it was submitted and has made a fix available. On Android, Claude combined three vulnerabilities to bypass a locked phone’s USB and pairing protections and extract photos and other personal data; Google has addressed the issue.

Anthropic says Claude also found a Windows kernel flaw that could let remote attackers crash and repeatedly restart machines responding to HTTP/3 requests. Microsoft fixed it as CVE-2026-33096. Claude identified the flaw through binary analysis, using a Windows executable and reverse-engineering tools such as Ghidra. Anthropic estimates several million internet-connected servers may be listening for such requests.

In Linux, a race-condition-induced use-after-free in the kernel networking stack allowed an attacker to send packets to a server with a multipath TCP listener and run commands as root, without credentials or user interaction. The exploit first defeated KASLR (a technique that randomizes kernel memory locations) to reveal a kernel address, then hijacked control flow. Anthropic’s proof of concept took 48 minutes to leak a kernel pointer and another five minutes to execute a shell command. CVE-2026-98432 was patched upstream and backported to all maintained stable kernel branches. Anthropic also reports finding local privilege escalation flaws in OpenBSD, FreeBSD and Linux, sandbox escapes, and vulnerabilities in web applications.

Anthropic says running many different scanning agents in parallel and increasing test-time compute helped find more vulnerabilities. Its platform tracks each scanner’s added findings and code coverage, using coverage-based, goal-based and threat-model-based approaches; confirmed findings pass through verification and risk rating, and Claude runs automated variant analysis on them. The company recommends scanning code when developers submit pull requests to catch vulnerabilities entering codebases, and says it released a Claude Code plugin with security guidance publicly.

Anthropic says frontier models can combine vulnerabilities into working exploits with little human involvement, a capability it says was previously limited to specialist teams. It argues that defenders need access to powerful models to gain time to patch before attackers act. The company says its expanded Cyber Verification Program gives qualifying security professionals access to advanced cyber capabilities and reduced blocking classifiers, including Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1. Anthropic’s advice to defenders is to scan their own code.

Anthropic says an unreleased internal research model, Claude, found critical vulnerabilities in widely used browsers, operating systems and other software over the past few months. The company describes five attack chains that led to remote code execution or other critical impacts with little to no user interaction; vulnerabilities in the affected products could put billions of users at risk. Anthropic says it reported each finding to the relevant vendor under coordinated vulnerability disclosure, which allows 90 days for patching and a further 45 days before discussion beyond public advisories.

In Chrome, Claude combined vulnerabilities in V8, the browser’s JavaScript engine, CacheStorage and FedCM to escape security boundaries and run code as the user. Anthropic says its proof of concept opened Calculator from a default Chrome browser on macOS within seconds of a page loading, without further user interaction. Google assigned and patched 62 CVEs as of Chrome 156; all were rated critical or high severity, including 13 sandbox escapes and 21 flaws that could compromise the renderer process.

For Safari, Claude chained flaws to bypass the same-origin policy, which normally restricts a website from reading data from other sites. The exploit could access browsing history, cookies and session databases, and send authenticated requests to other domains. It used memory read/write access to change a security flag, object size and URL, without arbitrary code execution. Apple acknowledged the report the day it was submitted and has made a fix available. On Android, Claude combined three vulnerabilities to bypass a locked phone’s USB and pairing protections and extract photos and other personal data; Google has addressed the issue.

Anthropic says Claude also found a Windows kernel flaw that could let remote attackers crash and repeatedly restart machines responding to HTTP/3 requests. Microsoft fixed it as CVE-2026-33096. Claude identified the flaw through binary analysis, using a Windows executable and reverse-engineering tools such as Ghidra. Anthropic estimates several million internet-connected servers may be listening for such requests.

In Linux, a race-condition-induced use-after-free in the kernel networking stack allowed an attacker to send packets to a server with a multipath TCP listener and run commands as root, without credentials or user interaction. The exploit first defeated KASLR (a technique that randomizes kernel memory locations) to reveal a kernel address, then hijacked control flow. Anthropic’s proof of concept took 48 minutes to leak a kernel pointer and another five minutes to execute a shell command. CVE-2026-98432 was patched upstream and backported to all maintained stable kernel branches. Anthropic also reports finding local privilege escalation flaws in OpenBSD, FreeBSD and Linux, sandbox escapes, and vulnerabilities in web applications.

Anthropic says running many different scanning agents in parallel and increasing test-time compute helped find more vulnerabilities. Its platform tracks each scanner’s added findings and code coverage, using coverage-based, goal-based and threat-model-based approaches; confirmed findings pass through verification and risk rating, and Claude runs automated variant analysis on them. The company recommends scanning code when developers submit pull requests to catch vulnerabilities entering codebases, and says it released a Claude Code plugin with security guidance publicly.

Anthropic says frontier models can combine vulnerabilities into working exploits with little human involvement, a capability it says was previously limited to specialist teams. It argues that defenders need access to powerful models to gain time to patch before attackers act. The company says its expanded Cyber Verification Program gives qualifying security professionals access to advanced cyber capabilities and reduced blocking classifiers, including Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1. Anthropic’s advice to defenders is to scan their own code.