Anthropic reports that an unreleased internal research model built five attack chains against Chrome, Safari, Android, Windows and Linux. Its October 27 research account describes working demonstrations and says it reported the vulnerabilities to the affected vendors.
Evidence status: vendor-reported controlled demonstrations, with supporting platform advisories. The article supplies no confirmed in-the-wild campaign or measured count of compromised users. Its examples also involve different security failures: browser escape, cross-site data access, physical-device access and remote denial of service are separate outcomes.
A website crossing a sandbox is different from crossing an origin
Chrome: Anthropic describes a malicious page gaining code execution outside the browser’s sandbox on macOS. A sandbox is the process boundary that limits what web content can access. Several vulnerabilities had to work together to cross it.
The company says Google assigned 62 CVEs to its findings, all patched by Chrome 156. That is Anthropic’s count, not 62 vulnerabilities in this single demonstrated chain.
Google’s linked October 20 desktop release identifies 156.0.8078.47 on Linux and 156.0.8078.47/.48 on Windows and Mac. It credits multiple findings to Anthropic researchers assisted by Claude. These are the cited release’s fixed-build baselines, not a recommendation to downgrade a newer browser.
Safari: Anthropic describes bypassing the same-origin policy, the boundary between websites’ data, and accessing stored browser information. It explicitly calls this a data-only attack: changing security-relevant memory enabled access without relying on arbitrary code execution. Calling every browser example remote code execution would misstate this result.
The linked Apple advisory credits Milad Nasr and Nicholas Carlini with Claude for CVE-2026-43715, a WebKit memory-corruption flaw. It records iOS 26.5.2 and iPadOS 26.5.2, released June 29, as containing its fix. That supports an earlier component fix; it is not a complete macOS Safari patch matrix or independent validation of the entire chain.
For browser fleets, check the version actually running after updates and restarts. For Apple platforms, match the device and OS branch to Apple’s applicable security release. The research publication date does not make every underlying issue a new October zero-day.
Remote server exposure depends on the listener
Linux: Anthropic’s demonstration targets a server with a multipath TCP listener, which accepts connections using multiple network paths. It reports remote root-command execution through CVE-2026-98432, a race involving memory that had already been freed.
The Linux-maintained CVE record confirms an IPv4 networking lifetime bug and lists branch-specific fixes. On the 6.12 upstream branch, 6.12.113 is the listed first unaffected release. Other branches have different fixed versions, and distribution packages may backport the repair.
Use the distribution’s advisory to establish whether the deployed kernel contains this CVE’s fix, then ensure the repaired kernel is actually running. Anthropic’s listener prerequisite describes its demonstrated exploit; it does not prove that every other configuration is unaffected by the underlying bug.
Windows: the research reports remotely crashing machines that expose the affected native HTTP/3 implementation, the newer HTTP transport. It associates the issue with CVE-2026-33096.
Microsoft’s CVE record describes a network denial-of-service vulnerability in HTTP.sys, Windows’ HTTP service component. It was published April 14 and provides separate affected-build ranges for Windows and Windows Server products. Use the Microsoft product matrix for the installed edition; there is no single universal Windows fixed-build number.
Neither example establishes that every Linux or Windows machine is remotely reachable through the required service. Prioritize affected, reachable listeners and verify the platform fix.
A stolen phone is another threat model
Android: Anthropic says its locked-phone data-extraction chain required physical access and testing on a Pixel 9. It says Google addressed the issue, but supplies no CVE or fixed-build matrix for the chain.
That leaves insufficient detail to prescribe a particular Android patch level from this article. Follow the device vendor’s current security updates and physical-device protection guidance. Do not turn a demonstrated Pixel configuration into a claim that all locked Android phones expose their data remotely.
Caveat: Anthropic sells the models and promotes its security programs in this research. Platform records corroborate individual vulnerabilities and fixes, but do not independently reproduce the complete chains or quantify the human work involved.