Anthropic Says Unreleased AI Found 62 Chrome Flaws, All Now Patched

Anthropic says an unreleased, internal AI model found critical security flaws in Chrome, Safari, Android, Windows and Linux. It says every flaw was reported to the vendor and fixed before it went public. The company’s Frontier Red Team described the work on 27 October. Anthropic presents it as a warning that AI can now do work once limited to a handful of specialist teams, and as a push for defenders to scan their own code.

For most people the practical step is simple: keep browsers, phones and servers updated. The fixes below are already out.

What was fixed, and where

Anthropic says the model built five “attack chains”, linking several flaws so that one malicious step could cause serious harm with little or no user action. Here is what each one could have done and how it was fixed, based on Anthropic’s account and the vendors’ own records:

• Chrome. A malicious web page could have run code on a user’s computer. Anthropic says its reports led to “62 CVEs” being “assigned and patched as of Chrome 156, with all of them rated critical or high severity”. Google’s Chrome 156 release notes, published on 20 October, list 15 critical or high-severity fixes reported by Xinyang Ge, one of the post’s authors, five of them marked “assisted by Claude”. The 62 total is Anthropic’s count across releases. Chrome 156 is version 156.0.8078.47 on Linux and 156.0.8078.47/.48 on Windows and Mac.
• Safari. A malicious website could have read data from other sites a user was signed in to. Anthropic says Apple “acknowledged our report the same day we submitted it” and that the “fix is available to users”. Anthropic gives no CVE number for this one. Apple’s Safari 27.2 notes, released on 26 October, credit Anthropic researchers on several WebKit fixes, but neither company has said which entry matches this chain.
• Android. Someone holding a stolen, locked Google Pixel 9 could have pulled photos and personal data off it. Anthropic says “this issue has been addressed by Google”, without giving a CVE or patch date.
• Windows. An attacker could have crashed any Windows machine answering HTTP/3 requests through Windows’ built-in implementation, and kept crashing it. Microsoft fixed this as CVE-2026-33096 in its 14 April 2026 updates. It lists the bug as an HTTP.sys denial-of-service flaw, rated Important (CVSS 7.5), credits “Milad Nasr (Anthropic) and Calif.io with Claude”, and says it was neither publicly disclosed nor exploited. Microsoft’s listed stopgap for unpatched machines is to turn off HTTP/3. Anthropic estimates there are “likely several million such servers listening on the internet”.
• Linux. Anthropic says a remote attacker could have run commands with full control of Linux servers that accept multipath TCP connections, with no login. It gives the number CVE-2026-98432 and says the fix was “patched upstream and backported to all maintained stable kernel branches”. The official record for that number, published on 15 October, describes a race-condition memory bug in the kernel’s IPv4 TCP connection handling. The CNA rates it critical (CVSS 9.8), and fixed releases include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10. The upstream fix names an Anthropic researcher as the reporter. The record itself makes no mention of multipath TCP, so that link rests on Anthropic’s account.

Anthropic says it also found local privilege-escalation flaws in OpenBSD, FreeBSD and Linux, sandbox escapes, and bugs in web applications. It gave no detail on these.

How the disclosure worked

Anthropic says every flaw went through coordinated disclosure. Vendors get 90 days to patch, and Anthropic then waits “a further 45 days” before discussing anything beyond the public advisory. That timing shows in the records: Microsoft’s fix shipped in April, the Linux fix landed upstream in early October, and Chrome 156 reached the stable channel on 20 October, a week before Anthropic’s post.

Tools for defenders

Anthropic pairs the findings with two offers. It says it has publicly released a security plugin for Claude Code, its coding tool, so teams can check code for flaws at the pull-request stage before it ships. Its expanded Cyber Verification Program, announced on 6 October, gives vetted security teams access with fewer safety blocks, including Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1. It now has three tiers: Defense Access, Red Team Access and Specialized Access. “Scanning your own code is more important than ever,” the company says.

Why the speed of patching now matters most

The uncomfortable part of Anthropic’s post is the capability claim. The company says finding and combining several flaws into a working attack “has historically been the domain of few specialist teams”, and that models can now do it “with little human involvement”. If that holds, the gap between a flaw being found and a working attack existing gets much shorter, for defenders and attackers alike.

The vendor records here show why that matters. Every vendor named shipped a fix, and Microsoft says its bug was never exploited. Protection still depends on those fixes reaching machines. A patched kernel only helps once a distribution ships it and a server is rebooted, and a browser fix only helps once the update installs.

This fits a pattern TSN has tracked this month. Anthropic has used Claude to prove 239 open-source entry points crash-free, and Google says its BigSleep agent found 45 flaws in Chrome’s JavaScript engine to a fuzzer’s 37. AI is becoming a standard bug-hunting tool. One question is how Anthropic keeps this unreleased model out of the wrong hands. The other is whether vendors and IT teams can patch at the pace these tools now find flaws. More coverage is in TSN’s cybersecurity section.

Sources

1. Anthropic Frontier Red Team, “Discovering and exploiting vulnerabilities in critical, real-world software with Claude”, 27 October 2026: https://www.anthropic.com/research/discovering-vulnerabilities-with-claude
2. Google, Chrome Releases, “Stable Channel Update for Desktop” (Chrome 156), 20 October 2026: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
3. Microsoft Security Response Center, CVE-2026-33096: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33096
4. NVD, CVE-2026-98432: https://nvd.nist.gov/vuln/detail/CVE-2026-98432
5. Linux kernel, “ipv4: free inet_opt and ireq_opt after an RCU grace period”: https://github.com/torvalds/linux/commit/e3f33b0a1d89d738e2b913dab519226eaf76e15b
6. Apple, “About the security content of Safari 27.2”, 26 October 2026: https://support.apple.com/en-us/149527
7. Anthropic, “Expanding the Cyber Verification Program”, 6 October 2026: https://www.anthropic.com/news/cyber-verification-program

Related stories

• Anthropic Says Claude Proved 239 Open-Source Entry Points Crash-Free
• Google’s BigSleep AI Found 45 Chrome Engine Flaws to a Fuzzer’s 37