Unreleased Claude built five working exploits, all now patched

An unreleased version of Claude chained four separate Chrome bugs into one malicious webpage that launched macOS Calculator when a user loaded it. That was the harmless proof of concept. The chain underneath it was a one-click remote code execution path that broke Chrome’s JavaScript engine, its memory protections, its process isolation, and its federated sign-in, each bug clearing a different control until the exploit escaped the browser sandbox.

It was one of five working exploits the model produced across Chrome, Safari, Android, Windows, and Linux, Anthropic’s Frontier Red Team said this week. Every affected vendor has patched. Building chains like these used to take teams with specific domain expertise, the researchers wrote; now it is “something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify.”

The Chrome figures are the most checkable part. Anthropic reported 62 vulnerabilities to Google, all assigned CVEs, all rated high or critical, all patched by Chrome 156.

The Safari chain combined four weaknesses: a use-after-free in JavaScriptCore, a bypass of WebKit’s Gigacage memory protection, a hole in the WebContent sandbox, and a second JavaScriptCore flaw. Together they let JavaScript on any site defeat the same-origin policy and read another site’s data: browsing history, cookies, session data. Anthropic’s framing is that if you are signed into webmail the attacker reads your mail, and if you are in your bank they can view balances or attempt transfers. Apple has fixed it.

The Android exploit went after a locked Pixel 9. Three bugs in Android’s device-transfer and USB-handling logic, bypassing four layers of protection, pulled photos and other personal data off the phone without unlocking it. Google has addressed it. The Windows exploit was a remotely exploitable denial of service: an out-of-bounds read in the Windows kernel’s HTTP/3 transport implementation that a few crafted packets can trigger, crashing a vulnerable server and letting an attacker crash it repeatedly. Microsoft has patched. On Linux, a zero-click chain against the kernel networking stack gave an unauthenticated remote attacker root-level command execution, CVE-2026-98432, patched upstream and backported to every maintained stable branch.

What the report leaves out matters as much as what it reports. Andrew Bolster of Black Duck points out that the Chrome, WebKit, Windows, and Linux fixes are public and verifiable, but the claim that Claude found them autonomously is Anthropic’s own, and the report gives no success rates, no cost, and no human-hours per chain. The preconditions were real: the Android chain assumed a stolen phone and a USB cable, and the Linux exploit needed an exposed MPTCP listener. Exploit benchmarks drop sharply once ASLR, stack canaries, and sandboxing are enabled, Bolster notes, and VulnCheck found only 1.3% of AI-discovered vulnerabilities confirmed exploited in the wild. Delivery, reliability, and target preconditions stay the attacker’s problem for now, he says, though he expects that gap to narrow.

Jacob Krell of Suzu Labs draws the same line. Finding the bug is now cheap; getting it to work on a server the model has never seen is still the expensive part. “A shell on one honeypot tells you little about the next server’s worker count, build, or kernel.” His caution is that the distance between a proof of concept and a reliable, broadly deployable attack is becoming a question of time and target-specific adaptation rather than rare expertise.

Anthropic’s advice to defenders is to scan their own code, and the company is widening access to its strongest models, including Claude Opus 5.5, Sonnet 5.5, and Mythos 5.1, for vetted security professionals through a three-tier Cyber Verification Program.

John Strand of Black Hills Information Security warns against assuming this needs frontier compute. A Mac Studio with 128GB or a DGX Spark can run AI-assisted reverse engineering and vulnerability research locally, and the target, model, tooling, and operator’s skill all shape what comes out. Against smaller, less-scrutinized code it may be more practical than against hardened platforms. If a model can find bugs in Chrome, Windows, Android, and Linux, all of which absorb enormous review, Strand’s question is what that implies for the code that gets almost none: the IP cameras, the firmware on the router running a remote office. All of it is in play.

---

Contains a referral link.