al-ice.ai

Five Chains, Four Flaws in One Browser: Claude Turns Vulnerability Discovery Into Working Exploits

AI Security Research by al-ice.ai Editorial

On 27 October 2026 Anthropic’s Frontier Red Team published five end-to-end exploit chains against Chrome, Safari, Android, Windows, and Linux, each found and weaponized into a working proof of concept by an unreleased, internal research model after what the company describes as initial prompting with little human involvement. The headline number is on the Chrome chain: 62 CVEs reported to Google, all rated critical or high and patched as of Chrome 156, including 13 sandbox escapes and 21 renderer-compromise flaws. Every chain below was reported to its vendor first and is already patched — Anthropic says it discloses under a policy giving developers 90 days to patch plus 45 more before it discusses details beyond a public advisory. The exploits were built in the lab; none was observed in a real attack.

The Chrome chain is the most complete demonstration of multi-bug reasoning. From one visit to a malicious page on a stock, default-configuration Chrome on macOS, the model’s proof of concept launched the Calculator app outside the browser sandbox within seconds. It did so with four separate flaws in sequence: a V8 JavaScript-engine vulnerability corrupting the heap, a second flaw escaping V8’s memory-region sandbox and defeating ASLR with a ROP chain to own the renderer, a race condition in CacheStorage that let the compromised renderer read out-of-sandbox memory and map the privileged browser process, and a use-after-free in FedCM, Chrome’s federated sign-in feature, that delivered arbitrary code execution outside the sandbox. Google’s release notes credit “Xinyang Ge of Anthropic, assisted by Claude” for specific Chrome fixes — worth noting as independent confirmation of authorship for at least part of the 62, though not all of them.

The Safari chain is arguably the more interesting research result because it never executes attacker code at all. The model found a use-after-free in JavaScriptCore where TypedArray operations wrote through stale pointers, then discovered that variables inside WebKit’s Gigacage isolation region were used to index into other regions — yielding arbitrary read/write outside the cage. A vulnerability in the WebContent sandbox’s IPC mechanism then exposed Safari’s stored history, cookies, and session databases from disk, and the chain finished by overwriting a variable in memory to switch off the same-origin policy, letting any malicious page read mail, banking sessions, and cookies from other origins. Several links in this chain are not vulnerabilities on their own but intended behaviors that become exploitable only in combination — exactly the compositional reasoning that separates exploit chaining from bug finding. Apple acknowledged the report the same day and shipped the fix; its notes credit “Milad Nasr and Nicholas Carlini with Claude, Anthropic.”

The remaining three chains widen the aperture from browsers to operating systems. On Android, the model combined open-source analysis, deobfuscation of Play-services binaries, and live testing on a physical Pixel 9 into a lock-screen bypass that exfiltrated photos over USB from a still-locked, stolen phone — defeating the USB-data block, the pairing authorization check, the six-digit verification (behaving as if the user tapped “Allow”), and a hardcoded file-content check via an uncovered raw-bytes fallback path. On Windows, binary analysis with Ghidra surfaced an out-of-bounds read the company ties to CVE-2026-33096 (patched April 2026): a few packets to an HTTP/3 listener crash the machine, repeatable into a persistent denial of service across what Anthropic estimates as several million exposed servers. On Linux, a zero-click remote root against multipath-TCP listeners: leak a kernel address past KASLR in about 48 minutes, reach a root shell five minutes later, with failed attempts not crashing the target so retries are free. The company ties this chain to CVE-2026-98432 (9.8, fixed upstream 15 October), and notes additional local privilege escalations found on OpenBSD, FreeBSD, and Linux plus sandbox-infrastructure escapes.

Why defenders should take this seriously — and where to discount it

The serious part is the compositional claim: one model finding several flaws in one target and assembling them into a working exploit is, as Anthropic puts it, work that previously belonged to a few specialist teams — and the vendor credits from Google and Apple make the authorship hard to dismiss. The discount sits in the two places independent verification cannot reach. First, how much of each chain the model built alone is uncheckable: “initial prompting” and “little human involvement” are not broken down step by step, and the model is unnamed. Second, the two chains with independent paper trails both carry discrepancies worth stating plainly: the public record for CVE-2026-33096 describes HTTP.sys rather than the kernel QUIC handling Anthropic names, rates it 7.5, and credits no finder; the CVE-2026-98432 record describes an IPv4 TCP fix rather than a multipath-TCP one; and US government enrichment marks the Windows flaw as not exploited and outside the CISA KEV catalog. Neither discrepancy refutes Anthropic’s account — CVE descriptions routinely differ from finder write-ups — but authorship of those two chains currently rests on Anthropic’s post alone. Read alongside the S-1’s four sandbox escapes and the $2,283 Chrome chain from the spring, the direction is consistent: exploit construction is becoming a model capability to be measured, not a human craft to be assumed.

What it means for builders and defenders

  • Patch the boring parts of the stack, not just the browser. Chrome 156, the Safari fix train, the April Windows rollup, and the 15 October kernel fix collectively close all five chains. The Android chain is a reminder that physical-access assumptions need revisiting for high-risk users.
  • Treat “intended behavior” as composable attack surface. The Safari chain’s scariest property is that benign behaviors became a same-origin bypass in combination. Sandboxing reviews that audit each mechanism in isolation will miss this class; chain-aware review is the fix.
  • Budget for retryable remote exploits. The Linux chain’s failed attempts do not crash the target, so noisy-crash detection is not a control here. KASLR-bypass plus non-crashing retry means network-level anomaly detection on MPTCP listeners matters more than host-crash telemetry.
  • Join the defender side of the capability curve. Anthropic frames the release as defender aid and points vetted professionals to its expanded Cyber Verification Program (Claude Opus 5.5, Sonnet 5.5, Mythos 5.1). Whether or not you trust the framing, the capability it demonstrates is now a baseline your red team should assume exists on the other side too.

Our verification was read-only. Anthropic’s research post “Discovering and exploiting vulnerabilities in critical, real-world software with Claude” (Frontier Red Team, published 27 October 2026) was read first-hand, including all five chain write-ups, the 62-CVE/Chrome-156 figures, the 90+45-day disclosure policy, and the Cyber Verification Program note. The Hacker News report of 28 October 2026 was read first-hand for the vendor-credit strings, the fix versions, and the CVE-record discrepancies (CVE-2026-33096 HTTP.sys vs QUIC, CVE-2026-98432 IPv4-TCP vs MPTCP, no finder credited, not-exploited enrichment), which we restate as reported there. No model was run, no vendor was contacted, no exploit was reproduced, and all interpretation above is ours. Brave Search was used for discovery only.

Sources: