Anthropic reported five exploit chains against Chrome, Safari, Android, Windows, and Linux, but the outcomes ranged from code execution to data access and service disruption. In its October 27, 2026 account, the company attributed the work to an unnamed, unreleased internal research model and described a different result for each target. Anthropic’s report outlines the demonstrations and how its team conducted them.

What the five chains reportedly achieved

Chrome: Anthropic said a chain let a webpage trigger remote code execution outside Chrome’s sandbox, a security boundary that isolates the browser from the rest of the system. In its proof of concept, Calculator opened on macOS within seconds of a page loading in a default-configuration Chrome browser. Anthropic also said Google assigned and patched 62 CVEs, or Common Vulnerabilities and Exposures identifiers, by Chrome 156. All 62 were rated Critical or High; 13 were sandbox escapes and 21 could compromise the browser’s renderer, the component that processes web content.

Google’s separate desktop Chrome Stable update listed 52 security fixes. NeoTeo’s coverage of that Chrome update provides context on the separate release.

Safari: Anthropic described a data-only attack that bypassed the same-origin policy, a browser rule that normally restricts one website from reading another site’s data. The chain could access information such as browsing history, cookies, session data, or authenticated content from another site. Anthropic said it did not use arbitrary code execution.

Android: Anthropic said three vulnerabilities enabled data extraction over USB from a stolen, locked phone. Its researchers tested the chain on a physical Google Pixel 9; the reported extraction included photos and other personal information.

Windows: Anthropic described CVE-2026-33096 as a remotely triggerable denial-of-service flaw in the Windows kernel’s QUIC networking code. An attacker could send network packets to a system responding to HTTP/3 requests and repeatedly crash it. Anthropic said Microsoft resolved the flaw and estimated that several million internet-facing servers may have been listening for HTTP/3 requests.

Linux: Anthropic described CVE-2026-98432 as a kernel networking flaw that could let an attacker reach root command execution through a multipath TCP listener, without credentials or user interaction. In the company’s proof of concept, it took 48 minutes to disclose a kernel pointer and another five minutes to reach shell-command execution.

The research used human prompts and a prepared setup

Anthropic said the work began with human prompting and used scanning agents, a debugger, a fuzzer, and a sandboxed execution environment. Its account also describes coverage tracking, variant analysis, and a standardized process for verifying findings and rating risk. The company characterized the human involvement as limited.

For the Android chain, the reported target was a stolen, locked phone, while the researchers’ test device was a physical Google Pixel 9. Anthropic’s account describes researchers testing the chain; it does not attribute the theft of a phone to the model.

Red Hat describes the Linux CVE differently

Red Hat’s record for CVE-2026-98432 describes an IPv4 TCP race involving retransmitted connection requests or socket migrations. It gives denial of service or potential memory corruption as the impact, and rates the issue Critical for Red Hat Enterprise Linux with a preliminary CVSS 3.1 score of 9.8. Red Hat’s CVE record and Anthropic’s account therefore describe different networking paths and impacts under the same CVE identifier.

Anthropic reported coordinated disclosure

Anthropic said it reported each finding to the affected vendor through coordinated vulnerability disclosure. The company described a process that gives developers 90 days to patch, followed by a further 45 days before Anthropic discusses details beyond public advisories. Its account presents the chains as proof-of-concept research and describes the vendor notifications.