Anthropic says an unreleased Claude model turned software weaknesses into working exploits against major browsers and operating systems during research tests.
The company detailed five exploit chains in an Oct. 27 report. Researchers tested the techniques under controlled conditions and disclosed the vulnerabilities to affected vendors.
Several demonstrations breached safeguards designed to contain malicious activity or prevent unauthorized access to protected information.
Browser flaws defeated protections around code and private data
In Chrome, a specially crafted webpage triggered a chain of four vulnerabilities that ultimately ran code outside the browser's sandbox, which normally isolates website activity from the computer.
Claude used a flaw in the V8 JavaScript engine to corrupt memory, overcame another restriction on protected memory, and exploited weaknesses in browser storage and federated sign-in to complete the escape.
On macOS, loading the test page opened Calculator within seconds, without additional user action. Anthropic also identified 62 high- or critical-severity Chrome CVEs patched as of version 156, including 13 sandbox escapes and 21 flaws capable of compromising the rendering process.
Safari's protections could be bypassed without executing arbitrary code. Claude crossed boundaries separating website data, reaching browsing history and cookies that could expose information about signed-in accounts. Apple issued a WebKit security fix credited to researchers working with the model.
Android data extraction and remote server attacks
With physical access to a Google Pixel 9, the model retrieved photos and other personal files even though the screen remained locked. It circumvented USB data restrictions and device-pairing checks before transferring the information. Anthropic said Google corrected the flaw, although it did not identify the updated software build.
Anthropic said Windows machines responding to HTTP/3 requests through the native Windows implementation could be crashed remotely. Repeated malicious requests might prolong the outage and disrupt dependent services. Microsoft addressed the issue under CVE-2026-33096.
On Linux, Anthropic demonstrated remote command execution as root against a server with a multipath TCP listener, without credentials or user interaction. Its proof of concept took approximately 48 minutes to obtain a kernel memory address and another five minutes to execute a shell command.
Kernel maintainers released a fix for CVE-2026-98432 and backported it to maintained stable branches. An Ubuntu security advisory, updated Oct. 28, still listed fixes as work in progress for several releases and kernel packages. Administrators should check the status for their installed kernel.
Security teams must assess how vulnerable systems can be reached
Corporate email and cloud applications often rely on browser sessions that attackers may misuse without installing malware. Security teams investigating possible account exposure should compare sign-in and session records with alerts from endpoint detection and response tools. Suspicious sessions need to be revoked, and affected browsers updated.
Remote server exploitation depends on whether attackers can reach the vulnerable service, not simply whether an affected software version is installed. Attack surface management inventories can help identify internet-exposed Windows and Linux systems and determine which need immediate attention. For services awaiting patches, restricting external connections can reduce the opportunity for exploitation.
A missing corporate Android phone calls for checks beyond its lock screen. Administrators can consult mobile device management systems for patch status and initiate a remote wipe where supported. Evidence of unauthorized physical access should prompt a review of associated business accounts and available OS and component updates. Because Anthropic did not identify a fixed build, administrators may need vendor guidance to verify remediation.
For each affected system, record when it was exposed, when the relevant fix was installed, and which logs cover that interval. Use credible signs of compromise to guide further investigation, and document gaps in visibility. Installing an update closes a known vulnerability, but it cannot establish whether earlier access occurred.
Read more: Beyond individual exploits, Claude’s discovery of 493 security issues in open-source software shows why security teams should test whether configured protections actually block unauthorized access.