Claude exploit chains: what Anthropic found, what to patch

Anthropic's Claude exploit chains are five working attacks that an unreleased internal Claude research model built against Chrome, Safari, Android, Windows and Linux. All five have been reported and fixed, so the practical answer is short: update your browser, phones, Windows servers and Linux kernels, and the table below shows which fix covers which chain.

Anthropic's Frontier Red Team published the details on October 27 in a post titled Discovering and exploiting vulnerabilities in critical, real-world software with Claude. The company says it found the bugs "over the past few months" and that each chain led to "remote code execution and other critical impacts with little to no user interaction."

What security people on X are saying

The reaction that got passed around came from @gf_256, a hacker and founder at Zellic: "Fully working, end-to-end exploits. Prompting was minimal like 'pls make RCE'." Models have been finding bugs for a while, so the part that stood out in that post was the model carrying each one through to an attack that runs.

Security specialist @0xABD was less impressed, joking that the "Claude" in the post might be a human. The complaint underneath is that Anthropic never names the model or describes its setup, and it's a fair one. The post says each exploit came "after initial prompting," but it never breaks down how much of each chain the model did alone.

The five chains and the fix for each

This comes from Anthropic's post, plus The Hacker News for the details Anthropic left out.

The Chrome chain linked four bugs: a V8 memory flaw, a V8 sandbox escape, a race condition in CacheStorage, and a use-after-free in FedCM that broke out of the browser sandbox. In the proof of concept, Calculator opened on a stock Mac within seconds of the page loading. Anthropic says its reports led to 62 Chrome CVEs, all rated critical or high.

The Linux chain is the scariest one on the list. It requires no login and no click. Per Anthropic, the model took about 48 minutes to leak a kernel address and about five more to get a root shell. On Windows, the company estimates "several million" exposed servers.

How to check you're covered

Each of these takes a few minutes per device:

• Chrome: open chrome://settings/help, let it update, and click Relaunch. You want version 156 or higher.
• iPhone and iPad: Settings, General, Software Update.
• Android: Settings, System, Software update. Pixel owners should install whatever is pending.
• Windows servers: confirm the April 2026 cumulative update is installed, especially on any IIS box with HTTP/3 turned on.
• Linux servers: update the kernel through your distro's package manager, then reboot, because the new kernel isn't running until you do. If a hosting company runs the box for you, ask them whether CVE-2026-98432 is patched.

One caution from the reporting: The Hacker News found that the public CVE records for the Windows and Linux bugs don't fully match Anthropic's descriptions, and the Android fix has no public record yet. Patch anyway, but don't read a CVE number as proof of exactly what was fixed.

What Anthropic tells defenders to do

The post's advice is blunt: "scanning your own code is more important than ever." Anthropic says it put security checks into its own development process through a Claude Code plugin and released it publicly as security-guidance in its official plugins repo. If your team already uses Claude Code, adding that plugin is the cheapest thing on this list. Our post on Claude Code mods covers how plugins and add-ons fit into it.

Anthropic also expanded its Cyber Verification Program, which gives vetted security professionals fewer blocked requests and access to its strongest cyber models. Open-source maintainers have a separate route through the free Anthropic OSS Scanner.

My read

This lands a month after Anthropic said open-weight GLM-5.3 writes exploits nearly as well as its locked-up models, which we covered in A free AI model now writes exploits. Patch faster. Taken together, I think the time between a bug going public and someone attacking it keeps shrinking. The model behind these chains is locked away, but the free ones are not far behind, if Anthropic's own GLM-5.3 testing is right.

For a small business the fix is still boring: turn on automatic updates everywhere and make one named person responsible for the servers. You just get less time to get around to it. If nobody in your office could say who patches what, that's the kind of gap New Face Design's free process audit is meant to find.