Anthropic’s AI Built Five Working Attack Chains. What We Can Verify, and Why the Patch Window Just Shrank

By Thorsten Meyer | October 29, 2026 | ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

A Mac. A fresh copy of Chrome with default settings. Someone opens a web page, and a few seconds later the Calculator app pops up. Nobody clicked anything else.

A calculator is the most harmless proof in computer security. If a web page can open it, the page could have run anything else on that computer. On October 27, Anthropic’s Frontier Red Team said the attack behind that calculator was written by Claude: an unreleased, internal research model that found four separate bugs in Chrome and chained them into one working exploit. The team described four more chains like it, on Safari, Android, Windows and Linux. The most serious one let a remote attacker run commands as root, the all-powerful administrator account, on certain Linux servers. No password, no click.

All of this happened in a lab. Anthropic says it reported every flaw to the vendor first, and the fixes are out. So this is not an emergency. It is a preview of a world where finding a bug and building the attack become one step. Here is what the five chains are, what I could check in the vendors’ own records, what remains Anthropic’s word, and what it means for companies and for everyone with a phone.

Key takeaways

• An AI model went from bug to working attack, five times. Anthropic says an unreleased research model found flaws in Chrome, Safari, Android, Windows and Linux and, “after initial prompting”, chained them into working exploits (Anthropic, October 27). Every flaw was reported to the vendor first.
• The fixes are real and checkable. Google’s Chrome 156 release notes, Apple’s advisory for iOS 26.5.2 and Microsoft’s advisory for CVE-2026-33096 credit Anthropic researchers working “with” or “assisted by” Claude. The Linux flaw has a public CVE rated 9.8 out of 10. For the Android chain, I found no public record.
• Not checkable: how much the humans did. Anthropic speaks of “little human involvement” but gives no breakdown, and it does not name the model.
• The real story is the patch window. In 2017, WannaCry hit 59 days after Microsoft’s patch. In a lab test Anthropic published in June, a model needed under an hour to turn a public Firefox fix into a working exploit. That is Anthropic’s own lab measurement, not a real attack.
• Defenders get the same tools, under conditions. Anthropic’s public models “block most cyber work”; vetted security teams can apply for more. OpenAI runs a similar push. For everyone else, the defense is boring: update fast, and restart.

Products Worth Considering

Logitech MX Keys S Wireless Keyboard, Graphite

AmazonView Latest Price

Jackery HomePower 3000 Portable Power Station with Two 200W Solar Panels

AmazonView Latest Price

Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The short answer

Think of a burglar facing a garden gate, a front door and a safe. One broken lock is a real problem, but it rarely gets anyone to the money. Modern browsers and phones work the same way. They have several layers of protection, so a useful attack needs several bugs that fit together, one per layer. Security people call that an exploit chain.

Finding single bugs with AI has become routine this year (I looked at the numbers in the CVE wave piece). Building the whole route was the rare skill. In Anthropic’s words, these skills “have historically been the domain of few specialist teams”. Now, the post says, “it’s something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify.”

If that holds, the time between “a bug exists” and “a working attack exists” collapses. That is what changes.

Five chains, five very different threats

“Five platforms” sounds like five equal dangers. They are not. Two chains need nothing more than a visit to a web page, one needs a stolen phone in hand, one only crashes servers, and one takes over servers from the internet. Here they are in Anthropic’s order, at the level of detail Anthropic published, or less.

Chrome: one visit to a web page

Anthropic says Claude combined four flaws: a memory bug in Chrome’s JavaScript engine, a way out of that engine’s own memory sandbox, a timing bug that leaked the layout of the more privileged browser process, and a memory bug in a sign-in feature. The result ran code on the Mac as the user, outside Chrome’s sandbox. The proof of concept was that Calculator, opened “within seconds of the page loading, without any further user interaction”.

Anthropic says its Chrome reports produced 62 CVEs patched as of Chrome 156, all rated critical or high, including 13 sandbox escapes. Google’s Chrome 156 release notes (October 20) list 353 security fixes. By my count, 15 of them are credited to Xinyang Ge, one of the Anthropic researchers named on the post, five explicitly as “(Anthropic), assisted by Claude”. Four of the 15 are rated critical and 11 high. The total of 62 is Anthropic’s cumulative figure; I could not reconcile it with the release notes.

Safari: any website reads your other websites

This chain never runs its own code at all. It gains full read and write access to the browser’s memory and then flips a single setting: the same-origin policy, the rule that stops one website from reading another website’s data. With that rule off, a malicious page could read Safari’s history and cookies and act on sites where you are signed in. Anthropic’s example: your email, or your bank balance.

One line from the post deserves attention: “Several of the weaknesses are not vulnerabilities on their own but intended behaviors that become exploitable when combined.” Chaining turns features into weapons. Apple’s advisory for iOS and iPadOS 26.5.2 (released June 29) credits a WebKit use-after-free, CVE-2026-43715, to “Milad Nasr and Nicholas Carlini with Claude, Anthropic”.

Android: a stolen, locked phone

Here the attacker needs the phone in hand and a USB cable. Anthropic says Claude combined reading Android’s open-source code, reverse engineering of Google Play services and live tests on a physical Pixel 9. It chained three flaws that let an attacker copy photos and other personal data off a locked phone without unlocking it. Anthropic says “this issue has been addressed by Google”. I checked Android’s September and October security bulletins and Google’s acknowledgements page and found no entry crediting Anthropic, so this one rests on Anthropic’s word.

Windows: crash a server from the internet

The narrowest chain is a remote crash, not a takeover. A few network packets crash a Windows server that answers HTTP/3 web requests with Windows’ built-in implementation, and repeating them keeps it down. Anthropic estimates “several million such servers” on the internet. That is its estimate, not a scan I could check.

Microsoft fixed the flaw on April 14, 2026, as CVE-2026-33096, a denial-of-service bug in HTTP.sys, Windows’ built-in web request handler, rated “Important” (7.5 of 10). Microsoft’s advisory acknowledges “Milad Nasr (Anthropic) and Calif.io with Claude”, rated exploitation as “less likely” and offered switching off HTTP/3 as a stopgap.

This case also shows the human side. Anthropic writes that “we provided the model with a copy of the Windows executable and asked Claude to reverse-engineer how the software works”, rebuild it as an annotated program, compare the two, and then hunt for bugs. People set the plan; the model did the slow parts.

Linux: root over the network, no click

The most serious chain targets Linux servers with a multipath TCP listener, a networking feature that lets one connection use several network paths at once. Anthropic says a remote attacker could send packets and run commands as root, “without any credentials or user interaction”. The root cause is a timing bug in the kernel’s networking code. What makes it dangerous is that a lost attempt “only fails the handshake without crashing the whole system”, so an attacker can simply retry. In Anthropic’s proof of concept, that took 48 minutes for the first stage and five more to reach root.

Anthropic ties the chain to CVE-2026-98432, published October 15, rated 9.8 out of 10 and fixed upstream with backports to the maintained stable kernels. The public CVE text describes a fix in the kernel’s IPv4 TCP code and does not mention multipath TCP. As The Hacker News also noted, the link between the two rests on Anthropic’s post. Anthropic adds that it has found more “zero-click” remote code execution flaws in the Linux networking code, all since patched, plus privilege-escalation bugs in OpenBSD, FreeBSD and Linux.

What I could check, and what stays Anthropic’s word

Confirmed in vendor records: fixes and credits at Google (Chrome 156), Apple (iOS 26.5.2) and Microsoft (CVE-2026-33096); the Linux CVE, its 9.8 rating and its fix. On October 28, CISA’s catalog of known exploited vulnerabilities listed none of the four CVEs named here. That means no confirmed use in real attacks, not proof that none happened.

Anthropic’s word only: that the model did the chaining, the “initial prompting” and “little human involvement”, the 62 Chrome CVEs in total, the Android fix, the “several million” Windows servers, the link between the Linux chain and its CVE, and which model did the work.

My reading: every vendor credit names a human first. “Xinyang Ge (Anthropic), assisted by Claude.” “Milad Nasr and Nicholas Carlini with Claude.” “Milad Nasr (Anthropic) and Calif.io with Claude”, where Calif.io is an outside security firm. That fits the Windows description: expert-directed work with a very fast, very capable assistant, not a model running loose. It is no less important for that. The scarce part used to be the expert hours, and those are exactly what the model saves.

One more detail from the dates. The post says “over the past few months”, but the Windows fix shipped in April, the Safari fix in June, and the Linux and Chrome fixes in October. This is half a year of work in one post.

Independent reaction was still thin 48 hours after publication. The Hacker News wrote that the “capability claim rests on Anthropic’s own account.” I found no statement on this post from CISA or the UK’s National Cyber Security Centre. Both agencies, however, had already acted on the trend behind it, as the next section shows.

The window that keeps shrinking

To see why this matters, look at the gap between a patch and an attack. Once a vendor ships a fix, the fix itself is a roadmap: attackers compare the old and new code to find what changed. Everyone who has not installed the update yet sits in the “patch gap”.

Anthropic measured this in June (Measuring LLMs’ impact on N-day exploits). Historically, the post notes, this took weeks. WannaCry hit 59 days after Microsoft’s patch in 2017. The public exploit for Citrix Bleed took about two weeks in 2023. In Mandiant’s 2020 analysis, 16 of 25 known bugs took a month or more to be exploited. In Anthropic’s lab, Claude Mythos Preview needed less than an hour to get from a published Firefox fix to its first working exploit. Had it run on the day Mozilla published that fix, Anthropic notes, the exploit would have been ready 18 days before the patched Firefox even shipped. Across 18 Firefox patches it built 8 working exploits; across 21 Windows kernel patches, 8 chains that took a low-privilege user to full control of the machine.

Two fair caveats, both Anthropic’s own. These are lab conditions, and exploit development is only one step: finding targets, delivering the attack and avoiding detection still take time. But exploit development used to be the slowest step.

A real case from February shows what the gap looks like outside a lab. BeyondTrust’s advisory BT26-02 describes a critical flaw in its remote-support products that the firm Hacktron AI found “through their novel approach to AI-enabled variant analysis”. BeyondTrust patched its cloud customers and every instance with automatic updates on February 2 and published the advisory on February 6. Its timeline lists the first observed exploitation attempt on February 10. Attacks hit only self-hosted systems that were still unpatched, and CISA added the flaw to its catalog of exploited bugs on February 13. That catalog now notes known ransomware use. The systems that updated themselves were fine.

Governments have started to plan for this. On May 1, the UK’s National Cyber Security Centre told organisations to prepare for a “vulnerability patch wave”. Its CTO wrote that AI, “when used by sufficiently-skilled and knowledgeable individuals”, can exploit old software flaws “at scale and at pace”, and asked everyone to “update by default”. On June 10, the US cyber agency CISA issued Binding Operational Directive 26-04, which ties federal agencies’ patch deadlines to risk and, for the riskiest cases, allows three calendar days plus a check for compromise. Its stated reason: attackers’ “use of AI may further narrow the time defenders have to react between patch release and possible exploitation.” Note the NCSC’s qualifier. “Sufficiently-skilled” people with AI is exactly what Anthropic’s vendor credits show.

Defenders get the same tools

Anthropic frames the work as a head start for defenders: “Enabling defenders with powerful models is critical to giving them a headstart on patching systems before attackers do.” Its advice: “scanning your own code is more important than ever”, ideally at the moment a change is proposed, before new bugs land. It has released the security plugin it uses for Claude Code publicly for that purpose.

Access is tiered. Anthropic says its generally available models, Claude Opus 5.5, Fable 5.1 and Sonnet 5.5, “have conservative cyber safeguards that block most cyber work”. On October 6, it expanded its Cyber Verification Program into three tiers: Defense Access for defensive work, Red Team Access for authorized penetration testing by organizations, and Specialized Access, with the fewest blocks, for a small set of organizations testing systems like power grids or flight software. For that last tier, Anthropic says it reviews “every organization in depth in collaboration with the US government”. Data retention is required so Anthropic can watch for misuse. Two days later it launched OSS Scanner, free scans for open-source projects, with reports that are fully model-generated and not reviewed by humans.

Anthropic is not alone. On October 21, OpenAI described Patch the Planet, its coordinated response to critical PHP flaws that the security firm Calif found with an OpenAI model (Wiz found them independently), which I covered in The 22-Year Road to PHP2Shell. OpenAI committed “$1 billion in subsidized Daybreak access” for under-resourced defenders and wrote that it expects “similar findings to increase sharply in the coming months.” Both labs present their programs as defense first, and both sell the access. Both things are true at once.

What Anthropic says it will and won’t release

• The model: unnamed, described only as “an unreleased, internal research model”. The post says nothing about whether or when it will be released.
• The exploits: no exploit code. The post describes each chain at component level, after the fixes shipped.
• The disclosure rules: Anthropic’s coordinated disclosure policy aims to give vendors 90 days to patch (a 14-day extension is possible), targets 7 days for actively exploited critical bugs, and generally waits 45 days after a patch before publishing full technical details.
• The access: public models block most cyber work; vetted defenders apply for tiers, which Anthropic says will include “other new models moving forward”.

Where this sits in Anthropic’s safety rules

Anthropic’s Responsible Scaling Policy (RSP) is its rulebook for when a model needs stronger safeguards, organized around AI Safety Levels (ASL). The current version 3.4, in effect since July 8, 2026, sets its capability thresholds around chemical and biological weapons, AI that automates AI research, and misaligned AI in high-stakes settings. When I searched the policy text, the word “cyber” did not appear. Cyber capability does not trigger an ASL gate under the current RSP. Anthropic handles it with classifiers, access tiers and its disclosure policy instead.

Anthropic’s August 2026 Risk Report explains the logic, in a passage about biological weapons: “Unlike in some other domains such as cyberoffense, it is hard to envision a way in which AI-assisted countermeasures could outweigh AI-assisted risks.” Read the other way round, Anthropic bets that in cyber, defense can win if defenders get the tools first. The same report calls Claude Mythos Preview “a leap forward in offensive cyber capability” and says Anthropic held it back from public release until safeguards were in place. It also raised one risk rating, for misaligned AI in high-stakes settings, from “very low” to “low” after “recent incident disclosures related to model behavior in cybersecurity evaluations”. The report also notes the UK AI Security Institute’s account of a cyber test of Claude Mythos 5, which I covered in Why the AI Didn’t Stop.

My reading: the bet is defensible, but it depends on two things Anthropic does not control. How fast vendors and companies actually install fixes, and how fast similar capability spreads to models without these guardrails.

What this means for companies

1. Plan for hours, not weeks. For internet-facing systems, set patch deadlines in days and keep an emergency path for critical fixes. Measure the time until the fix runs in production, not until it is downloaded.
2. Patching includes restarting. Browser updates apply after a relaunch, kernel fixes after a reboot or a live patch. An installed but inactive fix protects no one.
3. Turn on automatic updates wherever the risk allows. BeyondTrust’s February timeline is the argument: auto-updated customers were patched before the advisory went out.
4. Switch off what you don’t use. Microsoft’s stopgap for the Windows bug was to disable HTTP/3. Know which servers expose features like HTTP/3 or multipath TCP, and why.
5. Prioritize by real-world exploitation and exposure. Watch CISA’s known-exploited catalog and your vendors’ advisories, and start at the perimeter, as the NCSC advises. Don’t wait for a severity score to be filled in.
6. Scan your own code with AI before someone else does, at the moment changes are proposed, and budget human time to check the findings.
7. Ask your software suppliers two questions: how fast do you ship critical fixes, and do you scan your own code with these tools?

What this means for users

1. Turn on automatic updates for your browser, phone and computer, and restart when asked. The Chrome and Safari fixes only protect you once the browser has restarted.
2. Understand why “zero-click” matters. Careful clicking does not help against an attack that needs no click, or only a page visit. Updates do.
3. Protect your phone for the day you lose it. Use a PIN, keep updates on and know how to wipe it remotely. The Android chain needed the phone in hand, which is exactly the lost-or-stolen case.
4. Retire devices that no longer get updates. An old phone or laptop will never receive these fixes.
5. Don’t panic. These flaws are fixed, and none of them is listed as exploited. This story is about how fast the next ones will be used, not about these.

Honest limits

• This is the vendor’s own report. The capability claims, the “little human involvement” and the model’s identity rest on Anthropic’s account. There is no exploit code to check, and that is the right call.
• Partial confirmation. Vendor records confirm the fixes and credits for Chrome (15 entries in Chrome 156, not all 62), Safari and Windows. The Linux CVE exists, but its link to multipath TCP comes from Anthropic. For Android, I found no public record.
• Lab, not the wild. These were proof-of-concept attacks built in a lab. There is no public evidence that any of the chains was used in a real attack.
• The patch-window numbers come from Anthropic’s own June lab test. The historical comparisons (WannaCry, Citrix Bleed, Mandiant) are public cases cited in that post.
• Commercial interest. Anthropic sells security products and access to its strongest models, and the post points to that program. OpenAI does the same. That does not make the findings false, but it is worth keeping in mind.
• Early days. Two days after publication, independent expert reactions were few. Details may change.

Verdict

Finding a bug and building the attack used to be two jobs, done by different people at different speeds. This report says one model can now do both. Whether that means “little human involvement” or skilled people with a very fast assistant, the consequence for the rest of us is the same: the time between a fix and an attack is shrinking toward zero. A fix only counts once it is installed.

Sources

• Anthropic Frontier Red Team, “Discovering and exploiting vulnerabilities in critical, real-world software with Claude”, October 27, 2026
• Google, Chrome Releases, “Stable Channel Update for Desktop” (Chrome 156), October 20, 2026
• Apple, “About the security content of iOS 26.5.2 and iPadOS 26.5.2”, released June 29, 2026
• Microsoft Security Response Center, CVE-2026-33096, HTTP.sys Denial of Service Vulnerability, April 14, 2026
• CVE-2026-98432 (Linux kernel), record published October 15, 2026, via Tenable
• CISA, Known Exploited Vulnerabilities Catalog, version of October 28, 2026
• The Hacker News, “Anthropic’s Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits”, October 28, 2026
• Anthropic, “Measuring LLMs’ impact on N-day exploits”, June 8, 2026
• BeyondTrust, Security Advisory BT26-02 (CVE-2026-1731), updated February 13, 2026
• UK National Cyber Security Centre, “Preparing for a ‘vulnerability patch wave'”, May 1, 2026
• CISA, Binding Operational Directive 26-04, “Prioritizing Security Updates Based on Risk”, June 10, 2026
• Anthropic, “Expanding the Cyber Verification Program”, October 6, 2026
• Anthropic, “Launching an opt-in vulnerability-finding service for open-source software”, October 8, 2026
• Anthropic, “Coordinated vulnerability disclosure for Claude-discovered vulnerabilities”, updated March 6, 2026
• Anthropic, Responsible Scaling Policy, version 3.4, effective July 8, 2026
• Anthropic, Risk Report, August 2026
• OpenAI, “Patch the Planet: global response coordination as agents uncover critical vulnerabilities”, October 21, 2026

Related on ThorstenMeyerAI.com: Attackers now go after your AI tools · CVEs are going to the moon: the patch gap · AI has taken the clock off cyberattacks · PHP2Shell: what to patch, restart and check

Researched and drafted with AI assistance, including Anthropic’s Claude.