Threat reportVulnerabilityTL-2026-4624
Anthropic Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Android, Windows and Linux Exploits (CVE-2026-33096, CVE-2026-98432)
Anthropic Unreleased AI Model Chains Flaws Into Working (TL-2026-4624), also tracked as Anthropic Frontier Red Team AI exploit research, is a high-severity software vulnerability scored CVSS 8.1, first published 2026-10-28. It has no confirmed attribution, affects Google Chrome (macOS), references 2 CVEs (CVE-2026-33096, CVE-2026-98432), maps to 6 MITRE ATT&CK techniques (T1005, T1190, T1203), and is covered by 9 detection rules and 7 indicators of compromise.
- CVSS
- 8.1/10High
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-4624
- Threat ID
- TL-2026-4624
- Also known as
- Anthropic Frontier Red Team AI exploit research
- Severity
- HIGH
- CVSS
- 8.1
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, finance, telecoms, consumer
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
How Anthropic Unreleased AI Model Chains Flaws Into Working works
Anthropic's Frontier Red Team reported that an unreleased internal AI model found vulnerabilities and chained them into working proof-of-concept exploits for Chrome (macOS), Safari (iOS/iPadOS), Android (Pixel 9 lock-screen data extraction), Windows HTTP.sys and the Linux kernel networking stack. All flaws were coordinated-disclosed and patched; only lab demonstrations are reported and no in-the-wild exploitation is documented.
On 2026-10-27 Anthropic's Frontier Red Team published research (covered by The Hacker News on 2026-10-28) describing an unreleased internal research model that autonomously discovered vulnerabilities and produced working exploits that can be run and verified. The work followed a 90-day vendor patch window plus a 45-day embargo before public discussion, and every flaw was patched before publication.
Chrome (macOS): a chain of four flaws starting from V8 heap memory corruption, an ASLR defeat via sandbox escape, a CacheStorage race condition used to leak the browser process memory layout, and a FedCM use-after-free to gain code execution outside the sandbox (the PoC launches Calculator without user interaction). Anthropic reports 62 CVEs assigned, all critical or high, including 13 sandbox escapes and 21 renderer vulnerabilities, patched in Chrome 156 (stable 2026-10-20). Individual Chrome CVE IDs are not listed in the sources reviewed.
Safari (iOS/iPadOS): a JavaScriptCore use-after-free in TypedArray operations, a Gigacage isolation bypass, and a WebContent sandbox IPC flaw give access to disk-stored history, cookies and sessions; a memory overwrite then disables the same-origin policy, enabling cross-site data theft as a data-only attack with no arbitrary code execution. Patched in iOS/iPadOS 26.5.2 (June 29) per the news report; individual CVE IDs are not listed.
Android: a USB authorization bypass chain (device-transfer protocol authorization check circumvention, skipped authenticated key-agreement verification of a 6-digit code, and a hardcoded USB transfer check bypassed via a fallback mechanism) extracts photos and personal data from a locked Pixel 9. Google reportedly fixed it; no public record or CVE ID was found.
Windows: CVE-2026-33096 (CWE-125, CVSS 7.5) is an unauthenticated remote out-of-bounds read in HTTP.sys (kernel QUIC handling, reachable over HTTP/3) that crashes or restarts the host; repeated requests sustain denial of service. Publicly disclosed 2026-04-14 and patched by Microsoft.
Linux: CVE-2026-98432 is a race-condition use-after-free in the kernel networking stack (Wiz describes it as an IPv4 TCP inet_opt/ireq_opt UAF, CWE-416, CVSS 8.1, introduced in 4.4 by commit 079096f103fa; Anthropic reports exploitation against multipath TCP listeners). The chain races to cause a kernel pointer overread defeating KASLR (about 48 minutes), then a buffer overflow overwrites a callback pointer and a ROP chain runs arbitrary commands as root (about 5 additional minutes). The hunt skeleton cited CVSS 9.8; the independently found Wiz record shows 8.1, so 8.1 is used here. Fixed in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7 (upstream commit e3f33b0a1d89d738e2b913dab519226eaf76e15b). No public PoC, in-the-wild exploitation or CISA KEV entry was reported as of 2026-10-15.
The significance for defenders is the demonstrated speed and low human involvement of AI-driven exploit development, which shortens the time between patch release and weaponization. No threat actor, malware, C2 infrastructure or network IOCs are attributed. IOC entries below are defensive indicators and components derived from the sources, not adversary infrastructure.
MITRE ATT&CK techniques used in TL-2026-4624
Collection
Initial Access
T1190 Exploit Public-Facing Application; T1461 Lockscreen Bypass
Execution
T1203 Exploitation for Client Execution
Credential Access
T1212 Exploitation for Credential Access; T1539 Steal Web Session Cookie
Affected products and versions in Anthropic Unreleased AI Model Chains Flaws Into Working
- Google — Chrome (macOS)
Vulnerable versions: prior to 156
Fixed in: 156 - Apple — Safari / iOS / iPadOS
Vulnerable versions: prior to 26.5.2
Fixed in: iOS/iPadOS 26.5.2 - Google — Android (Pixel 9 USB transfer flow)
Vulnerable versions: not specified
Fixed in: fixed by Google, version not specified - Microsoft — Windows HTTP.sys
Vulnerable versions: not specified in sources
Fixed in: April 2026 security update - Linux — Linux kernel
Vulnerable versions: 4.4 and later prior to fixed releases
Fixed in: 5.10.272; 5.15.223; 6.1.190; 6.6.159; 6.12.113; 6.18.56; 7.2.10; 7.3-rc7
Remediation for Anthropic Unreleased AI Model Chains Flaws Into Working
Patches
- Chrome 156 (stable 2026-10-20)
- iOS/iPadOS 26.5.2 (Apple security update)
- Microsoft April 2026 update for CVE-2026-33096
- Linux upstream commit e3f33b0a1d89d738e2b913dab519226eaf76e15b and stable backports
Immediate actions
- Update Chrome to version 156 or later on all platforms
- Update iOS/iPadOS to 26.5.2 or later
- Apply the April 2026 Microsoft security update for CVE-2026-33096 on internet-facing HTTP.sys servers
- Upgrade the Linux kernel to a fixed release (5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 or later) or apply distribution backports
Workarounds
- Linux: sysctl -w net.ipv4.tcp_migrate_req=0 reduces one vulnerable code path for CVE-2026-98432 but does not fully mitigate it
- Windows: limit exposure of HTTP.sys services (including HTTP/3) until patched
Longer-term hardening
- Shorten patch SLAs for browsers, mobile OS and kernel updates given AI-accelerated exploit development
- Add PR-time security scanning to catch new vulnerabilities before merge
- Keep Android devices on current security patch levels and restrict USB data access on lost or stolen devices
CVEs associated with Anthropic Unreleased AI Model Chains Flaws Into Working
Weaknesses (CWE) in Anthropic Unreleased AI Model Chains Flaws Into Working
Timeline of Anthropic Unreleased AI Model Chains Flaws Into Working
- CVE-2026-33096 (HTTP.sys out-of-bounds read DoS, CVSS 7.5) publicly disclosed and patched by Microsoft
- Apple releases iOS/iPadOS 26.5.2 patching the Safari flaws chained in the research
- CVE-2026-98432 published and fixed upstream in the Linux kernel with stable backports; no public PoC or exploitation reported
- Chrome 156 reaches the stable channel, patching the 62 Chrome CVEs reported by Anthropic
- Anthropic publishes 'Discovering Vulnerabilities with Claude' after a 90-day patch window and 45-day embargo
- The Hacker News reports the research; flaws described as patched and not exploited in the wild
Sources cited for Anthropic Unreleased AI Model Chains Flaws Into Working
- Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
- Anthropic: Discovering Vulnerabilities with Claude
- Wiz Vulnerability Database: CVE-2026-98432
- Wiz Vulnerability Database: CVE-2026-33096
- NVD: CVE-2026-33096
- Microsoft MSRC: CVE-2026-33096 HTTP.sys Denial of Service
- CraftedSignal brief: HTTP.sys DoS (CVE-2026-33096) with Sigma detections
- Chrome 156 security update
Detection coverage for TL-2026-4624
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4624 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.