AI Model Chains Bugs Into Working Exploits for Chrome, Safari, Windows and Linux

Anthropic has published details of an unreleased, internal research model that found multiple security flaws across Chrome, Safari, Android, Windows and Linux, then combined them into working proof-of-concept exploits with little human steering. Every flaw was disclosed to the affected vendor under coordinated disclosure and has already been patched. None of the chains has been observed in a real attack.

What happened

The claim that matters here is not any single bug. Finding one memory-corruption flaw is routine. Linking several separate flaws into a reliable exploit that escapes a browser sandbox or reaches a root shell has historically been the work of a handful of specialist teams. Anthropic says its model did that end to end on five platforms, needing only initial prompting.

The five chains, in brief:

Chrome. Four flaws in sequence: a memory corruption in the V8 JavaScript engine, an escape from V8's internal memory sandbox into the renderer, a race condition in CacheStorage that leaked the memory layout of the privileged browser process, and a use-after-free in the FedCM sign-in feature that completed the sandbox escape. The demo opened Calculator on a stock Mac seconds after the page loaded, with no further interaction. Anthropic says it handed Google 62 Chrome flaws in total, all rated high or critical, including 13 sandbox escapes, and that all are fixed as of Chrome 156. Google's release notes credit Anthropic researchers working with Claude for some, but not all, of those fixes.

Safari. This chain never executes native code. It gains full read and write access to browser memory and flips a single value to switch off the same-origin policy, the rule that stops one site from reading another's data. With that rule gone, a malicious page can read history and cookies and send authenticated requests to other sites: email, banking, anything the user is signed in to. Apple fixed the central use-after-free in iOS and iPadOS 26.5.2 and credits Anthropic researchers working with Claude.

Android. The least detailed of the five: a chain that pulls photos and other data off a locked, stolen phone over USB. Google has fixed it, but there is no public advisory to check against.

Windows. The narrowest in impact and the only one with an independent paper trail. A few crafted packets crash the machine, and repeating them keeps it down. It does not run code or steal data. Anthropic describes an out-of-bounds read in the kernel's QUIC handling. The CVE it points to, CVE-2026-33096, is recorded against HTTP.sys with a CVSS score of 7.5, names no finder, and as of late October is marked not exploited and is absent from CISA's Known Exploited Vulnerabilities catalog.

Linux. The most severe outcome: commands as root, over the network, with no credentials and no user action. The target must have a multipath TCP listener running. The model first leaked a kernel address to defeat KASLR, then reused the same race-condition use-after-free to redirect execution into attacker-placed code. The proof of concept took 48 minutes to leak the address and five more to reach a shell, and a failed attempt does not crash the host, so an attacker can retry indefinitely. The linked CVE-2026-98432 is a kernel use-after-free rated 9.8, fixed upstream on 15 October.

Why it matters

A few things deserve a cool head.

• Verifiable vs. not. The patches exist, and Apple and Google publicly credit Anthropic for specific fixes. What nobody outside Anthropic can check is how much of each chain the model built unassisted. The company speaks of "little human involvement" but does not document who did what at each step, and it does not name the model beyond calling it unreleased.
• Loose ends in the public record. The Windows CVE describes a different component than Anthropic does, and the Linux CVE's public text covers an IPv4 TCP fix rather than multipath TCP. The two descriptions may well be the same bugs, but only Anthropic's account links them.
• The trend is the story. Even discounted for marketing, the direction is clear: the cost of turning a bug into a working exploit is falling, and it is falling fastest for whoever has the strongest models. Patch windows that felt comfortable last year will feel tight next year.

Anthropic frames the work as a defensive contribution. It says each flaw went through a disclosure process giving vendors 90 days to patch plus 45 more before technical details are discussed, and it points security teams to its vetted-access program for Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1.

What to do

None of these chains is a live threat today, but the patches are only useful if they are installed.

1. Browsers and phones. Push Chrome 156 or later to every managed endpoint and confirm the update actually applied; Chrome is the platform with 62 fixed flaws behind it. Make sure iPhones and iPads are on 26.5.2 or later, and that Android devices carry current security patches.
2. Linux servers. Check whether multipath TCP is enabled (sysctl net.mptcp.enabled). If you do not need it, turn it off. Either way, move to a kernel that carries the fix for CVE-2026-98432. Internet-facing hosts first.
3. Windows servers. Apply the April 2026 cumulative update covering CVE-2026-33096 on anything serving HTTP/3, or disable HTTP/3 where it is not required.
4. Shorten the patch cycle. Treat this as a preview. If exploit development is becoming cheap, the time between a public fix and a working attack will shrink. Measure your mean time to patch on internet-facing assets and set a target you can defend.

The common failure mode is not ignorance of the CVE but not knowing which of your hosts still carries it. 4tify's vulnerability scanning service continuously checks exposed systems for known, patched-but-not-applied flaws like these and flags the ones that remain open.