Anthropic says an unreleased Claude model found serious vulnerabilities in Chrome, Safari, Android, Windows and Linux, and wrote working exploits for them. In a post published October 27, 2026, its Frontier Red Team says it "used an unreleased, internal research model to find critical vulnerabilities in some of the world’s most widely used software." Anthropic describes "five attack chains, which led to remote code execution and other critical impacts with little to no user interaction." It says each was reported to the vendor, and the vendors have shipped or made fixes. This article covers what each flaw could do and what to update. It does not describe how the exploits work.

#What did Anthropic find?

Anthropic does not name the model. It reported each flaw under a policy "which gives developers 90 days to patch and a further 45 days before we discuss details beyond what is already included in a public advisory." That is why most fixes shipped months before the post. Dark Reading reported on October 29, 2026: "In total, Anthropic said, the model generated five working exploits targeting Chrome, Safari, Android, Windows, and Linux."

#What should you update?

#Chrome

Anthropic describes "One-click remote code execution in Chrome." It says "62 CVEs have been assigned and patched as of Chrome 156," "with all of them rated critical or high severity." That count is Anthropic's; no Google document we read states 62. Dark Reading also attributes it: "Anthropic said it reported 62 vulnerabilities to Google, all of which had been assigned CVE identifiers, rated high or critical, and patched by Chrome 156."

What to do: make sure desktop Chrome is on version 156 or later.

#Safari, iPhone, iPad and Mac

Anthropic says its Safari exploit "could access a user’s Safari history, cookies, and other sensitive data, and could send authenticated HTTP requests to other domains and read the responses." It adds: "Apple acknowledged our report the same day we submitted it and implemented a fix promptly."

Apple's iOS 26.5.2 security notes, "Released June 29, 2026," credit "CVE-2026-43715: Milad Nasr and Nicholas Carlini with Claude, Anthropic" for a WebKit flaw. Apple lists the impact as "Processing maliciously crafted web content may lead to memory corruption." The same credit appears in Safari 26.5.2 for "macOS Sonoma and macOS Sequoia" and in macOS Tahoe 26.5.2. Apple's notes credit Anthropic for this one CVE only.

What to do: run iOS or iPadOS 26.5.2 or later, macOS Tahoe 26.5.2 or later, or Safari 26.5.2 or later. Apple's security releases page lists iOS 26.7.2, macOS Tahoe 26.7.2 and Safari 27.2 from October 26, 2026, which include the fix.

#Android

Anthropic calls this an "Android lock screen bypass." It says Claude "wrote an exploit that let an attacker extract photos and other personal information from a stolen Android phone without unlocking it," tested on "a physical Google Pixel 9." Anthropic says: "This issue has been addressed by Google."

No Google bulletin we checked names the issue, and Anthropic gives no CVE, patch level or date. What to do: we cannot tie this fix to a specific update. Keeping Android and Google Play system updates current is good practice, but no Google document confirms which update contains it.

#Windows

Anthropic says the Windows exploit "would have allowed an attacker to remotely crash any Windows machine that responds to HTTP/3 requests using the native Windows implementation." It estimates "there are likely several million such servers listening on the internet."

Microsoft's Security Update Guide lists CVE-2026-33096 as an "HTTP.sys Denial of Service Vulnerability." Microsoft rates it Important, with a CVSS score of 7.5, and marks it not exploited. It was released on April 14, 2026, and affects Windows 11 versions 23H2, 24H2, 25H2 and 26H1, and Windows Server 2022, Windows Server 2022 23H2 and Windows Server 2025. Microsoft also documents a temporary mitigation and notes: "After you install the security update, you no longer need this mitigation."

What to do: install the April 14, 2026 cumulative update or any later one. This is not a new Windows patch.

#Linux

Anthropic describes "Zero-click remote code execution in Linux." It says the exploit "allows a remote attacker to send packets to Linux servers with a multipath TCP listener to run arbitrary commands as root, without any credentials or user interaction." Anthropic says CVE-2026-98432 "was patched upstream and backported to all maintained stable kernel branches."

The NVD record shows the CVE was published on October 15, 2026, with a 9.8 Critical score supplied by the Linux kernel's CVE numbering authority. NVD has not analysed it itself.

What to do: install your distribution's kernel update that includes the fix for CVE-2026-98432.

#What do outside experts say?

Dark Reading quoted Andrew Bolster, senior R&D manager at Black Duck. It reported that he "says Anthropic's results are credible where they can be verified." It added: "The Chrome, WebKit, Windows, and Linux fixes are all public, he notes, but any claims that Claude discovered them autonomously are Anthropic's own." Bolster told Dark Reading: "The report gives no success rates, cost, or human-hours per chain, which is critical context for security leaders." He also said: "Delivery, reliability, and target preconditions remain the attacker’s problem for now, though I'd expect that gap to narrow."

Jacob Krell of Suzu Labs told Dark Reading: "AI has made finding the bug cheap. Getting it to work on a server it has never seen is still the expensive part."

#What is Anthropic offering defenders?

Anthropic says: "Our advice to defenders remains the same: scanning your own code is more important than ever." It points security teams to its Cyber Verification Program, "which makes advanced cyber capabilities and reduced blocking classifiers available to qualifying security professionals." Dark Reading reported that "The program now has three access tiers."

For related coverage, see our stories on OpenAI's Patch the Planet PHP work, the Brotli remote code execution flaw and Claude Mythos 5 in Georgia.

Our analysis: The fixes are real and documented by Apple, Microsoft and NVD, so the practical message is simple: update. The bigger claim, that a model did this end-to-end work, is harder to judge. As Bolster notes, Anthropic gives no success rates, costs or human hours. The severity labels also differ: Anthropic describes "remote code execution and other critical impacts," while Microsoft rates the Windows flaw Important.

#What is still unclear?

  • The model. Anthropic does not name it or say when, or whether, it will be released.
  • Android. No CVE, patch level or date ties the fix to an update.
  • Chrome count. Google has not confirmed Anthropic's 62 CVEs figure in any document we read.
  • Autonomy. Anthropic gives no figures on how much human help each chain needed.