An internal research model of Claude has been shown to automatically craft working exploit chains for multiple major platforms — including Chrome, Safari, Android, Windows, and Linux — revealing vulnerabilities across one-click, zero-click, and bypass attack vectors. These were lab experiments by Anthropic’s Frontier Red Team, disclosed in a report published October 27, 2026. All identified security issues were responsibly reported and patched before any real-world impact.
Major Exploits Spanning Popular Platforms
In one scenario, Claude composed a full exploit chain that allowed code execution outside of Chrome’s sandbox on macOS within seconds of visiting a page. The chain exploited four separate bugs: a memory corruption in V8 (Chrome’s JS engine), a sandbox escape plus ASLR bypass, a race condition in CacheStorage leaking layout data of the privileged browser process, and finally a use-after-free bug in FedCM used to fully escape the renderer. Chrome 156 includes fixes for all 62 issues reported, many high-severity and critical.
On Safari, Claude broke same-origin protections using a bug in JavaScriptCore and bypassed WebKit’s Gigacage, then used an IPC sandbox flaw to access private history, cookies, and authenticated sessions — all without any code running on the device. Apple confirmed and addressed the report with a patch.
Claude also bypassed Android’s lock screen on a Google Pixel 9 via USB access. It chained together multiple flaws that disabled USB data protection, skipped pairing authorization, and ignored the six-digit PIN check. As a fallback path, raw file bytes were extracted bypassing hardcoded blocks. This vulnerability has since been patched by Google.
Windows Crash & Zero-Click Linux Root Access
On Windows, a remote crash bug was discovered through reverse-engineering that targets HTTP/3 via QUIC: a malformed packet can crash or reboot a server, with repeated attempts keeping the service down. Public records, however, attribute this vulnerability to the HTTP.sys driver, giving it a 7.5 severity score, with fixes already available since April 2026.
The most severe exploit Claude built is on Linux: zero-click remote root access on servers running multipath TCP services. The exploit leaks a kernel pointer (defeating KASLR), then exploits a race condition to overwrite a callback pointer, executing shell commands — no login required. The leak took 48 minutes in testing; shell access took only another five minutes. This links to CVE-2026-98432, rated 9.8 severity, though public documentation doesn’t specify multipath TCP in its description.
Anthropic found these flaws using parallel scanning agents and a rigorous validation pipeline. To help reduce future risk they released a security-guidance plugin and expanded access to strong verification workflows for vetted security staff. Speed of patching was emphasized as critical.
Users should upgrade Chrome to version 156 or newer, apply the latest Apple, Android, Windows, and Linux kernel updates, and follow best practices for system hardening.
What this reveals is that the auto-generated vulnerability landscape is advancing fast. As AI tools become more capable at discovering complex, chained exploits, defenders will need to shift from reactive patching to predictive defense — auditing code paths, threat modeling at the AI level, and building systems that assume attacks written by models may be just around the corner.
