Anthropic report: an unreleased Claude model found 62 Chrome CVEs and chained 5 working exploits, zero-click root on Linux

Anthropic’s Frontier Red Team reported on October 27 that an unreleased, internal Claude research model, after an initial prompt, located vulnerabilities on its own and wrote working exploit code for them: its submissions to Google were assigned 62 CVEs, all rated critical or high severity and patched as of Chrome 156, and its attack chain against the Linux kernel went from first packets to a root shell in about 53 minutes. The report appeared on Anthropic’s research page, and every finding went to the affected vendor under coordinated disclosure.

Key points

• Chrome is the largest single item: 62 CVEs across Anthropic’s submissions, including 13 sandbox escapes and 21 bugs that compromise the renderer, patched in Chrome 156 (October 20). The proof of concept opens the macOS Calculator from default-configuration Chrome seconds after a page load.
• Five chains span four vendors: the Chrome full chain, a Safari same-origin policy bypass, photo extraction over USB from a locked Pixel 9, a remote Windows crash via QUIC (CVE-2026-33096), and zero-click root on Linux multipath TCP (CVE-2026-98432).
• Mallory, a threat-intelligence platform, matched the claims against public records and found the public descriptions of both CVEs disagree with Anthropic’s mapping, and that the model’s autonomy “remains independently unverified.”

The five chains

The Chrome chain carries the most technical weight. The model started from a V8 heap-corruption bug, used a second bug to defeat V8’s memory-region sandbox and ASLR via a ROP chain, then won a race condition in CacheStorage to read outside the renderer sandbox and map the privileged browser process’s memory, and finally exploited a use-after-free in FedCM — the federated sign-in flow — to run code outside the sandbox. Anthropic’s described end state: Calculator launching on macOS seconds after page load, with no further user interaction. The Safari chain starts from a use-after-free in JavaScriptCore, overwrites TypedArray metadata through stale pointers, and defeats the Gigacage to gain arbitrary read/write outside it; a WebContent sandbox IPC bug then reads the history, cookies, and session databases Safari keeps on disk, and finally the same use-after-free overwrites a variable in memory to disable the same-origin policy. Anthropic notes this is a data-only attack — no code execution — yet it let any website’s JavaScript read history and cookies and send authenticated cross-origin requests. The Android chain targeted a physical Pixel 9: three chained vulnerabilities defeated the USB data-transfer block, the device-to-device pairing authorization check, and the six-digit lock-screen verification, which the phone treated as though the user had tapped “Allow,” plus a fallback raw-bytes USB path around a hardcoded file-content check. On Windows, the model found an out-of-bounds read in the kernel’s QUIC (HTTP/3) implementation, CVE-2026-33096: a few packets crash and restart the machine, repeatably, and Anthropic estimates several million internet-facing servers accept HTTP/3 — its own figure, not a measurement. The Linux chain, CVE-2026-98432, hits servers with a multipath TCP listener: a race-induced use-after-free in the kernel networking stack, where stage one leaks a kernel pointer through an attacker-controlled length field to defeat KASLR, and stage two overwrites a callback pointer via a buffer overflow, staging the payload through an ordinary protocol feature and chaining kernel calls into a shell as root. Lost races only fail the handshake, so retrying is free; the proof of concept took 48 minutes to leak a pointer and five more to reach a shell.

How autonomous it was

Every chain carries the same qualifier: “after initial prompting.” The report does not say how much human steering happened after that prompt, and that gap is the easiest thing to miss when the headline travels. What it does document is method. The Windows bug surfaced from binary analysis with Ghidra and other tools — an annotated C reimplementation of the kernel code, diffed against the binary — and only after the model was asked for higher-risk issues. The Android chain combined source review of AOSP, reverse engineering and deobfuscation of Google Play services binaries, and live testing on the Pixel 9. Anthropic credits test-time compute scaling and scanner diversity: a parallel scanning platform measured how many vulnerabilities each strategy added on top of the others, across coverage-, goal-, and threat-model-based approaches, with automated variant analysis on confirmed findings. Alongside the report, Anthropic shipped an expanded Cyber Verification Program — naming Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1 — for vetted security professionals, plus a Claude Code security-guidance plugin, with a recommendation to move vulnerability scanning to PR time.

The fact-check record

Mallory, a security outlet that tracks AI claims, published its own reconciliation on October 28 and concluded that the model’s “claimed autonomy and contribution to each exploit chain remain independently unverified,” urging readers to separate laboratory outcomes from unverified claims about autonomous exploitation. Three discrepancies stand out. The public record for CVE-2026-33096 identifies HTTP.sys rather than the QUIC implementation Anthropic describes; the April 2026 patch is rated 7.5, and Microsoft’s bulletin names no discoverer and does not reconcile the component mismatch. CVE-2026-98432 was fixed upstream on October 15 with a 9.8 rating, but its public description concerns IPv4 TCP rather than multipath TCP, so the mapping rests on Anthropic’s account alone. And the headline figure of 62 Chrome CVEs is only partially corroborated: Google’s release notes credit Xinyang Ge “assisted by Claude” for several fixes, not all 62. There is no public record of a fix for the Pixel 9 chain either. Some claims do check out: Apple acknowledged the Safari submission the same day and fixed the JavaScriptCore use-after-free — Mallory records it in iOS/iPadOS 26.5.2, with a Claude-assisted credit. Chinese coverage at IT之家 describes Safari as acknowledged and fixed the same day; the “same day” holds for Apple’s acknowledgment, and fix timelines vary by source. One more caveat: this all happened inside Anthropic’s own controlled experiment. Every bug went to its vendor, and the report describes no real-world attack.

Our take

Read against this site’s own timeline, the report lands as a pattern rather than a one-off: XBOW chained Chrome exploits with GPT-5.6 over six days for Google’s full $250,000 bounty on October 14, OpenAI’s red team disclosed an unauthenticated Brotli RCE on October 24, and Anthropic’s red team had already published on near-self-replicating small models and Claude solving the NIST elliptic-curve seed mystery. The economics are shifting from “AI assists the human bug hunter” to “the model hunts and weaponizes on its own,” while defenders work on a 90-day patch clock plus 45 days before details go public — a schedule that now favors the attacker’s side of the ledger. If you run infrastructure, two of these CVEs deserve a check today: confirm your HTTP/3-facing services have the April 2026 Microsoft patch, and turn off multipath TCP listeners on any server that does not need them. If you evaluate model capabilities, keep Mallory’s caveats attached: the autonomy claim is the vendor’s own, the CVE mappings have gaps, and no third party has verified the count of 62. But even discounted, the core result — a model chaining multi-bug exploits end to end — now has partial backing in Google’s and Apple’s own credit lines.