On October 27, 2026, Anthropic’s Frontier Red Team published a research post on finding critical flaws in widely used browsers and operating systems. The work used an unreleased, internal research model—not a shipping Claude Sonnet, Opus, or Haiku product release. Anthropic summarizes five attack chains that, in its telling, led to remote code execution or other critical impacts with little or no user interaction. Related reading: Claude Security Review vs Continuous Scanning, What Changes for Your Workflow.

What the research post reports (high level)

  1. Chrome one-click RCE. Anthropic says the model produced a full chain that could run arbitrary code outside the browser sandbox. After the report to Google, 62 CVEs rated critical or high had been assigned and patched as of Chrome 156, including sandbox escapes and renderer-compromise issues.
  1. Safari same-origin policy (SOP) bypass. The post describes a one-click chain that bypasses SOP for sensitive data access (such as history and cookies) and cross-origin reads—characterized as a data-only chain. Anthropic says Apple acknowledged the report and shipped a fix.
  1. Android lock-screen bypass. On a stolen device that remains locked, Anthropic reports a chain that could extract photos and other personal information. The post says Google has addressed the issue.
  1. Windows remote denial of service (CVE-2026-33096). Anthropic reports a memory-safety out-of-bounds read in the Windows kernel QUIC implementation that can remotely crash or restart machines listening for HTTP/3. Microsoft assigned CVE-2026-33096 and resolved it, per the post.
  1. Linux zero-click root (CVE-2026-98432). Anthropic describes sending packets to servers with a multipath TCP (MPTCP) listener so an attacker can run arbitrary commands as root without credentials or user interaction. CVE-2026-98432 was patched upstream and backported to maintained stable branches, according to the post.

Coordinated disclosure

Anthropic says each issue was reported under coordinated vulnerability disclosure (CVD): developers get a 90-day patch window, then a further 45 days before discussion beyond what is already in a public advisory.

For related AI-security notes on this site, see also Devin Security Upgrade Brings Claude Mythos Deep Scans and Enterprise Credits and CodeRabbit Covers Up to $5,000 in Deep Scan Usage Through November 8.

These chains have not been reproduced on this site, and CVE／patch status has not been independently verified. Prefer Anthropic’s research post for the public record. For reference only.