In a research post published 27 October 2026, Anthropic says that over the past few months it used an unreleased, internal research model to find critical vulnerabilities in widely used software and shares details of five attack chains (an exploit chain links several flaws into one attack; a proof of concept is a working demonstration exploit).

Anthropic says it reported each vulnerability to the affected vendor under its coordinated vulnerability disclosure policy, which gives developers 90 days to patch and a further 45 days before it discusses details beyond a public advisory. Per Anthropic: in Chrome, after initial prompting, Claude wrote a full chain (a V8 heap corruption bug, a V8 sandbox escape, a CacheStorage race condition and a use-after-free in FedCM) that runs arbitrary code outside the browser sandbox, with a proof of concept that launches Calculator on stock Chrome for macOS within seconds of a page loading, without further user interaction; Anthropic says 62 CVEs reported to Google have been assigned and patched as of Chrome 156, all rated critical or high, including 13 sandbox escapes.

In Safari, a data-only chain (a JavaScriptCore use-after-free, a Gigacage bypass and a WebContent sandbox IPC flaw) let any website bypass the same-origin policy and read Safari history, cookies and other data; Anthropic says Apple acknowledged the report the same day and its fix is available. On Android, an exploit chaining three flaws let an attacker extract photos and other personal data from a locked, stolen phone, tested on a Google Pixel 9.

On Windows, an out-of-bounds read in the kernel's QUIC implementation let an attacker remotely crash machines that respond to HTTP/3 requests; Anthropic says Microsoft resolved it as CVE-2026-33096. On Linux, a race-condition use-after-free in the kernel networking stack lets a remote attacker run commands as root on servers with a multipath TCP listener; Anthropic says this flaw, CVE-2026-98432, was patched upstream and backported to all maintained stable kernel branches, and its proof of concept took 48 minutes to leak a kernel pointer and five more minutes to reach command execution.

Anthropic says frontier models can now do this with little human involvement. The Hacker News (28 October) notes that Anthropic does not break down what a person did at each step, and that the public CVE-2026-33096 record names HTTP.sys and credits no finder.