Anthropic's AI-Built Exploit Chains: Chrome 156, Linux MPTCP and Windows QUIC Fixes to Apply Now

Anthropic says an unreleased internal research model built working exploit chains for Chrome, Safari, Android, Windows and Linux, and the headline fixes are already out. If you read one line: update Chrome to version 156 or later, install pending OS and Android updates, and patch any Linux server that listens for multipath TCP or any Windows server that answers HTTP/3. The disclosure, published on October 27, 2026 as "Discovering and exploiting vulnerabilities in critical, real-world software with Claude", is research, not an active campaign. Its relevance to people who run coding agents is practical: your agent runs as you, on a machine with a browser, a kernel and a network stack, and the time between a bug existing and a working exploit is shrinking.

This post summarizes what Anthropic published, separates what is verified in its write-up from what we could not check, and lists concrete steps. Beam did not test any of these exploits; everything below comes from Anthropic's post and the vendor notes it links.

TL;DR

What did Anthropic actually publish?

Anthropic describes five attack chains, each written by the model "after initial prompting." It says it reported every vulnerability to the affected vendor under its coordinated disclosure policy: 90 days to patch, plus 45 more days before it discusses details beyond a public advisory. The company frames these as examples of multi-step exploit building in both open-source and proprietary software.

How the Chrome chain worked

Anthropic's description is useful because it shows the model chaining the layers Chrome stacks up to contain a web page.

1. A vulnerability in V8, Chrome's JavaScript engine, let a malicious page corrupt heap memory.
2. A second bug broke out of V8's memory region sandbox and defeated ASLR, which located Chrome's code in memory. A return-oriented programming chain then took control of the renderer process.
3. The renderer was still confined by Chrome's process sandbox. A race condition in CacheStorage let it read memory outside the sandbox and learn the layout of the privileged browser process.
4. A use-after-free in FedCM, Chrome's federated sign-in feature, gave arbitrary code execution outside the sandbox.

Anthropic's proof of concept launches Calculator on stock macOS Chrome within seconds of the page loading. Of the 62 CVEs, it says 13 are sandbox escapes and 21 could be used to compromise the renderer, all rated critical or high. The company says all were patched as of Chrome 156.

The Safari and Android chains

The Safari chain is described as a data-only attack: it never relies on arbitrary code execution. A use-after-free in JavaScriptCore let TypedArray operations write through stale pointers. WebKit's Gigacage normally isolates that data, but variables inside it indexed other regions, giving a read/write primitive. A flaw in the WebContent sandbox's IPC mechanism exposed stored history, cookies and session databases, and a final overwrite disabled the same-origin policy. Anthropic's example: a signed-in email or bank session becomes readable by the attacker's page. Apple acknowledged the report the same day and shipped a fix.

On Android, the model worked from open-source code, deobfuscated Google Play services binaries and a physical Pixel 9. It chained three bugs: a USB host setting that bypassed the rule against data transfer on a locked phone, a skipped authorization check that started device-to-device pairing, and a flaw that skipped the six-digit code verification. A fallback path then sent raw file bytes over USB around a hardcoded check. This requires physical access to a stolen or seized phone, so it matters most for devices that hold agent credentials or authenticated sessions.

The Windows and Linux findings

The Windows bug is an out-of-bounds read in the kernel's QUIC implementation. Anthropic says an attacker can send a few packets to a listening HTTP/3 server to crash and restart it, repeatedly if desired, and estimates "likely several million such servers" are listening on the internet. The model found it from the binary: it was given the Windows executable, asked to reverse-engineer it with tools such as Ghidra, write an annotated C reproduction, compare behavior to the binary, then audit the code. Microsoft assigned CVE-2026-33096.

The Linux issue is the most severe on paper. A race-induced use-after-free in the kernel networking stack of a multipath TCP listener lets a remote attacker run commands as root with no credentials. Stage one defeats KASLR by making the kernel over-read an attacker-controlled length and echo back a kernel pointer. Stage two reuses the use-after-free to overwrite a callback pointer with a payload staged through an ordinary protocol feature. A lost race only fails the handshake rather than crashing the system, so an attacker can retry indefinitely. In the proof of concept, a kernel pointer leak takes 48 minutes and a root shell about five more. The fix, CVE-2026-98432 (the CVE text itself describes the plain IPv4 TCP handshake path, so do not assume non-MPTCP hosts are safe; see our patch-status follow-up), was patched upstream and backported to all maintained stable branches. Anthropic also mentions local privilege escalation bugs in OpenBSD, FreeBSD and Linux, sandbox escapes in popular sandboxing infrastructure, and bugs in web applications, without detailing them.

What we could and could not verify

We read Anthropic's post directly. We did not independently reproduce any exploit, and we have not checked the CVE records, Chrome release notes or Apple and Microsoft advisories ourselves; use the vendors' own pages for exact affected builds. Anthropic has not published a list of the 62 Chrome CVEs in the post text we read, and details for items still inside the 45-day window may be thin. Treat counts as Anthropic's claims about its own work.

What this means if you run AI coding agents

An agent such as Claude Code or Codex executes commands with your user's permissions, uses your browser sessions through tools, and reads your files. A browser or kernel exploit sits underneath every control the agent has. So the checks are mostly ordinary patch hygiene, done faster:

1. Update Chrome and other Chromium browsers to 156 or later and restart them. Open chrome://version to confirm.
2. Update Safari and macOS or iOS, and Android with the latest Google Play services update, especially on devices that hold credentials.
3. Windows servers answering HTTP/3: apply the Microsoft update for CVE-2026-33096.
4. Linux servers with multipath TCP listeners: install your distribution's kernel update for CVE-2026-98432, reboot, and check uname -r against the vendor advisory. If you do not need MPTCP, check your distribution's guidance on disabling it.
5. Scan code at pull-request time. Anthropic's advice is that scanning your own code "is more important than ever," and it points to a security-guidance plugin for Claude Code. See its Claude Code repository for the plugin.
6. Shorten your patch window. Anthropic's point is that producing a working exploit from a bug is something models do "with little human involvement." Our earlier reading of exploit speed in the PHP2Shell case reached the same practical conclusion: treat the gap between disclosure and patching as the risk.
7. Review what agents can reach. Browser sessions, SSH keys, cloud credentials and .env files are what an exploit would take next. See how API keys leak through logs and environment variables.

What Beam can and cannot do here

Beam does not patch software or detect browser, kernel or network exploits; it is not a kernel sandbox or an endpoint protection product. What it does apply to is the agent layer on top: it watches what Claude Code, Codex and similar agents do, flags risky actions such as credential exposure and destructive commands, and can deny some actions through hooks (PreToolUse for Claude Code and Codex). Its skill and MCP scanning uses 11 heuristics and a version-pin check, which is heuristic rather than semantic analysis, and missing cached policy fails open. Everything is stored on-device. If an exploit did land code on your machine, Beam's local event history can help you review what an agent touched in the period before. See how Beam works and what it watches.

What developers should watch next

Anthropic notes that its fuller technical detail on items under disclosure will follow after the 45-day window, and its earlier work shows the pattern. We covered its September threat intelligence report, the Mythos 5 evaluation involving a malicious pull request and, for security teams, Claude Security's continuous scanning. OpenAI's patch-the-planet disclosure framework addresses the same pressure from the vendor side. For the month's incidents, see the October 2026 attacks timeline.

Frequently asked questions

Which patches should I apply after Anthropic's October 27 disclosure?

Update Chrome to version 156 or later, install current Apple, Android and Google Play updates, apply the Microsoft fix for CVE-2026-33096 on any Windows server answering HTTP/3, and run a kernel that carries the upstream fix for CVE-2026-98432 if you expose a multipath TCP listener. Anthropic says these are patched or fixed.

Is Anthropic's model available to attackers?

Anthropic describes it as an unreleased, internal research model. It says its most capable released models are offered to vetted defenders through the Cyber Verification Program. The post does not say attackers have the model; it says the skill set is no longer limited to a few specialist teams.

Does CVE-2026-98432 affect my Linux laptop?

Only if the machine runs a multipath TCP listener reachable from an attacker. Anthropic describes the target as Linux servers with such a listener. Check your kernel vendor's advisory and update; the fix was backported to all maintained stable branches.

Should I do anything about my coding agent?

Keep the browser, kernel and OS under agents current, since an agent runs with your user rights. Anthropic also recommends scanning code at pull-request time and released a Claude Code security-guidance plugin for that.

When will full technical details appear?

Anthropic says it reports to vendors under coordinated disclosure: 90 days to patch and a further 45 days before it discusses details beyond a public advisory. Expect more detail later for items still inside that window.

Related reading

• Anthropic threat intelligence report, September 2026
• Mythos 5, AISI and a malicious GitHub pull request
• PHP2Shell and AI exploit speed
• Linux CVE-2026-98432: patch status and the "MPTCP only" claim checked
• October 2026 attacks timeline
• Linux KSMBD RCE: two CVSS 9.0 kernel flaws posted publicly before a fix
• Source: Anthropic, Discovering and exploiting vulnerabilities in critical, real-world software with Claude
• Source: Anthropic Frontier Red Team

Details are accurate as of October 28, 2026 and come from Anthropic's published post; vendor advisories may have changed since. Beam is a local prototype and its features are described as documented today.