Anthropic’s Frontier Red Team published an account on October 27 of five working exploit chains built by what it calls an “unreleased, internal research model”. The five are a one-click Chrome chain in four stages, a one-click Safari chain, a Pixel 9 lock-screen bypass, a Windows remote denial of service and a zero-click Linux kernel bug. Two carry CVE IDs in the post, CVE-2026-33096 for Windows and CVE-2026-98432 for Linux. The post never names the model, and we are not going to guess. S5 Labs has not seen the exploits, the model or any proof of concept; the fixed versions below come from vendor records, which in two cases describe the bug differently from Anthropic. Anthropic, Frontier Red Team post
The patch checklist
| Target | CVE | Component (vendor record / Anthropic) | Fixed in | Source |
|---|---|---|---|---|
| Chrome desktop | 62 CVEs, Anthropic’s count; no list | Renderer and sandbox, per Anthropic | 156 stable, 156.0.8078.47 (Oct 20); a second update, 156.0.8078.73/.74 (Oct 27), adds more Anthropic-credited fixes | Chrome Releases, Oct 20 · Oct 27 |
| Linux kernel | CVE-2026-98432 | IPv4 TCP request sockets / “multipath TCP listener” | 7.3; backports 7.2.10, 6.18.56, 6.12.113, 6.6.159, 6.1.190, 5.15.223, 5.10.272 | CVE.org · kernel.org |
| Windows Server and client | CVE-2026-33096 | Windows HTTP.sys / Windows kernel QUIC, HTTP/3 | April 14, 2026 cumulative updates (builds below) or later | MSRC |
| Safari, iOS, macOS | None given by Anthropic; post links Apple’s CVE-2026-43715 page | WebKit (Apple) / Safari same-origin policy (Anthropic) | iOS and iPadOS 26.5.2 for CVE-2026-43715; current Apple releases are from Oct 26 | Apple 127594 · Apple releases |
| Pixel 9 (Android) | None given | Lock screen, with a USB fallback, per Anthropic | “Addressed by Google”; no version or bulletin entry | Anthropic post |
Neither CVE is in CISA’s Known Exploited Vulnerabilities catalog as of the October 28 feed, and Microsoft marks CVE-2026-33096 as not publicly disclosed and not exploited. CISA KEV · MSRC
Windows: Microsoft says HTTP.sys, Anthropic says QUIC
Microsoft and the CVE text describe CVE-2026-33096 as an out-of-bounds read (CWE-125) in Windows HTTP.sys: Important, denial of service, CVSS 3.1 7.5, published April 14, 2026, exploitation “Less Likely”. QUIC and HTTP/3 do not appear in the CVE description. Anthropic describes the same ID as a bug in the Windows kernel’s QUIC implementation, reachable over HTTP/3, and attaches a “several million” estimate to it; the post, not Microsoft, is the source of that number. Both can be true, since HTTP.sys is where Windows serves HTTP/3 and Microsoft’s mitigation guidance does say HTTP/3, but the CVE record alone would not tell you this is a QUIC bug. NVD · MSRC · Anthropic post
The firmest link between the two is Microsoft’s April CVRF document, which credits “Milad Nasr (Anthropic) and Calif.io with Claude” alongside Microsoft’s WARP and MORSE teams. Nasr is a named contributor on Anthropic’s post. The NVD and CVE.org records carry no credit. MSRC CVRF, April 2026
| Windows version | Fixed build | KB |
|---|---|---|
| Windows 11 23H2 | 10.0.22631.6936 | KB5082052 |
| Windows 11 24H2 | 10.0.26100.8246 | KB5083769 |
| Windows 11 25H2 | 10.0.26200.8246 | KB5083769 |
| Windows 11 26H1 | 10.0.28000.1836 | KB5083768 |
| Windows Server 2022 | 10.0.20348.5020 | KB5082142 |
| Windows Server 2022 23H2 (Server Core) | 10.0.25398.2274 | KB5082060 |
| Windows Server 2025 | 10.0.26100.32690 | KB5082063 |
Builds from the MSRC CVRF; later cumulative updates supersede them. Windows 10, Server 2019 and Server 2016 are not on the affected list. The mitigation, for machines that cannot take the update, is to back up and remove the EnableHttp3 and EnableAltSvc values under HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters and restart; every http.sys-based server on that machine then stops serving HTTP/3. Microsoft does not say whether HTTP/3 is on by default for a given SKU. MSRC CVRF · MSRC
Linux: the record says IPv4 TCP, the post says multipath TCP
CVE-2026-98432 was published by the Linux CNA on October 15 at CVSS 3.1 9.8. The record and the fixing commit describe ordinary IPv4 TCP request-socket handling, tcp_v4_syn_recv_sock and IP options in the SYN-ACK, fixed with kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor(). IPv6 is not affected by the first issue; a second path needs net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program. Neither the record nor the commit mentions MPTCP. Anthropic calls the target a “multipath TCP listener”, and no source we found connects the two descriptions. If the public record is right, any IPv4 TCP listener is exposed, so do not gate the patch on net.mptcp.enabled. CVE.org · NVD · Anthropic post
The fix is commit e3f33b0a by Eric Dumazet, committed October 5 with a Reported-by line for Xinyang Ge at anthropic.com. It landed in 7.3-rc7 and shipped in Linux 7.3 on October 18; we read it on the GitHub mirror because git.kernel.org was serving a bot check. CVE.org lists the kernel as affected from 4.4 and fixed at 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. There is no 5.4 or 4.19 entry, and end-of-life trees get no fix. Commit on GitHub · CVE.org · kernel.org
Distribution status on October 28: Debian has fixes in bookworm-security (6.1.190-1, DLA-4841-1), trixie-security (6.12.113-1, DSA-6568-1) and the bookworm linux-6.12 backport (6.12.113-1~deb12u1, DLA-4850-1). Ubuntu rates it high but lists jammy, noble, 26.04 and 26.10 as “pending”, with no released kernel yet, and bionic, focal and xenial as “needed”. Red Hat rates it Moderate at CVSS 5.9, high attack complexity, availability impact only, and labels those metrics preliminary; we did not verify its RHEL version list. The gap between 9.8 and 5.9 has not been settled. Debian tracker · Ubuntu · Red Hat
Chrome: two stable updates, and what your headless bundles pin
Chrome 156 reached stable on October 20 as 156.0.8078.47 (Linux) and .47/.48 (Windows, Mac) with 353 security fixes; 15 credit Xinyang Ge or Anthropic, four Critical and 11 High, five of them “assisted by Claude”. A second stable update on October 27, 156.0.8078.73 (Linux) and .73/.74 (Windows, Mac), lists 52 fixes, four Critical, 46 High and two Medium. Eighteen credit Ge or Anthropic, including all four Criticals: CVE-2026-118306 (FileSystem), CVE-2026-118331 (FileAPI), CVE-2026-118348 (Skia) and CVE-2026-118344 (Layout). It is rolling out “over the coming days/weeks”. The 62-CVE figure is Anthropic’s; Google publishes no per-reporter total, and the notes do not say which CVEs belong to the chain. Chrome Releases, Oct 20 · Chrome Releases, Oct 27 · Anthropic post
Browser-agent fleets are the exposure that matters for practitioners: a one-click chain needs only a page load, and a headless agent loads whatever page it is told to. Both major automation libraries pin a Chromium older than the October 27 line. Puppeteer v25.16.0 (October 22) pins Chrome and chrome-headless-shell at 156.0.8078.47; its main branch rolled to .73 on October 28, unreleased. Playwright v1.64.1 (October 14) pins chromium and chromium-headless-shell at 156.0.8078.4, a pre-stable build; its main branch is on Chromium 157.0.8103.15, also unreleased, and 157 is not the October 27 fix line. We did not check whether any chain bug separates .47 from .73, so treat .73 as the target. Puppeteer v25.16.0 · Playwright v1.64.1
Apple and Android: nothing to check against
Anthropic gives no CVE or fixed version for the Safari chain, which it describes as a data-only same-origin-policy bypass. The post links Apple’s page for iOS and iPadOS 26.5.2 (June 29, 2026), where a WebKit use-after-free, CVE-2026-43715, is credited to “Milad Nasr and Nicholas Carlini with Claude, Anthropic”. Apple says WebKit, not JavaScriptCore, and nothing about the same-origin policy; the link between that CVE and the chain is Anthropic’s, and we cannot confirm it. Apple shipped iOS and iPadOS 27.2, iOS 26.7.2, macOS 27.2, 26.7.2 and 15.8.2, and Safari 27.2 on October 26; we have not read those pages’ credits. Read iOS 26.5.2 as the floor and the current release as the target. Apple 127594 · Apple security releases · Anthropic post
For the Pixel 9 chain, three bugs plus a raw-byte USB fallback that Anthropic tested on a physical device, the only patch status is Anthropic’s line that “this issue has been addressed by Google.” The Android bulletins for August through October and the Pixel bulletins for September and October carry no Anthropic credit, so there is no version to write down. Anthropic post
The model, the program and the plugin
The post says the five chains are a selection. The model also found unnamed local privilege escalations on OpenBSD, FreeBSD and Linux, sandbox escapes, web-application bugs and, in the post’s plural, zero-click Linux kernel networking vulnerabilities, of which one is the example written up. The contributors are Carlini, Dworken, Ge, Morris, Nasr, Rohlf and Tong. This is a different channel from OSS Scanner, which emails model-written reports to enrolled maintainers without review. Anthropic post
Anthropic also restates the Cyber Verification Program expansion from October 6: three tiers covering Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1 and new models going forward. The October 6 page lists Opus 5.5, Fable 5.1 and Sonnet 5.5 as generally available with conservative cyber safeguards. It limits Specialized Access to a small set of verified organizations, keeps Red Team Access to organizations, and still blocks actions that could cause physical harm or mass disruption in real time. Our CVP tiers article covers who should apply for which; the Mythos and Project Glasswing piece has the background, and Google’s Gemini 4 Carbon is taking its own defenders-first route. Anthropic, CVP expansion
The Claude Code security-guidance plugin is now public in the official plugin repository. Its README describes three layers: regex reminders on Edit and Write for about 25 patterns, an LLM diff review, and an agentic commit review that runs on git commit; the post separately recommends scanning at PR time. It installs with /plugin install security-guidance@claude-plugins-official, needs Claude Code 2.1.144 or later and Python 3.8+, and was bumped to 2.0.17 on October 27. The review model is the newest Opus the configured endpoint serves, falling back to claude-opus-5-5; SECURITY_REVIEW_MODEL pins it. We did not re-verify the README’s cost figure, its environment switches or its statement about what is sent to the model. security-guidance plugin
The disclosure terms
Anthropic’s coordinated disclosure policy, last updated March 6, 2026, sets a 90-day deadline and publishes after 90 days or a patch, whichever comes first, with a 14-day extension available. Actively exploited critical bugs get a seven-day target for a patch or mitigation, extendable by seven more days only if the maintainer is actively working on a fix. Thirty days of silence escalates to an external coordinator, and model-originated reports are labeled as such. The policy also says Anthropic “would generally wait 45 days” after a patch before publishing full technical details, while the post frames them as following the 90; plan around the policy’s version. Anthropic, coordinated vulnerability disclosure · Anthropic post
What to check
Headless Chrome. Run chrome --version on whatever binary your agents launch, chrome-headless-shell included, and compare it with 156.0.8078.73. Puppeteer’s and Playwright’s bundled browsers are on .47 and .4 until their next releases; pointing executablePath at a system Chrome on .73 gets there sooner.
Linux. Compare uname -r with the fixed list, then check your distribution’s tracker rather than kernel.org, since Ubuntu’s fixes were still pending on October 28. A disabled MPTCP is not protection; the public record describes plain IPv4 TCP.
Windows. Confirm the build against the table. On servers that must stay unpatched, decide whether losing HTTP/3 is acceptable before removing the two registry values; the change applies to every http.sys application on the host.
Apple. Install the October 26 releases. A device pinned below iOS 26.5.2 predates the one Anthropic-credited WebKit fix we could find.
Android. Nothing version-specific to verify; keep the Pixel security patch level current and watch the Pixel bulletins.
Sources
Anthropic
- Frontier Red Team post on the exploit chains — Anthropic
- Expanding the Cyber Verification Program — Anthropic
- Coordinated vulnerability disclosure for Claude-discovered vulnerabilities — Anthropic
- security-guidance plugin — Anthropic on GitHub
Windows CVE-2026-33096
- MSRC Security Update Guide entry, April 2026 CVRF — Microsoft
- NVD record — NIST
- Known Exploited Vulnerabilities catalog — CISA
Linux CVE-2026-98432
- CVE.org record — CVE Program
- NVD record — NIST
- Fixing commit e3f33b0a — Linux on GitHub
- Releases — kernel.org
- Debian security tracker, Ubuntu CVE page, Red Hat CVE page
Chrome and browser automation
- Stable Channel Update for Desktop, October 20, October 27 — Chrome Releases
- puppeteer-v25.16.0 — Puppeteer
- v1.64.1 — Playwright
Apple