# Anthropic Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Android, Windows and Linux Exploits (CVE-2026-33096, CVE-2026-98432)

> Anthropic's Frontier Red Team reported that an unreleased internal AI model found vulnerabilities and chained them into working proof-of-concept exploits for Chrome (macOS), Safari (iOS/iPadOS), Android (Pixel 9 lock-screen data extraction), Windows HTTP.sys and the Linux kernel networking stack. All flaws were coordinated-disclosed and patched; only lab demonstrations are reported and no in-the-wild exploitation is documented.

- **Published:** 2026-10-28T08:38:19Z
- **Last reviewed:** 2026-10-28T08:38:19Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4624
- **ID:** TL-2026-4624
- **Severity:** HIGH (CVSS 8.1)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-33096, CVE-2026-98432

## Description

On 2026-10-27 Anthropic's Frontier Red Team published research (covered by The Hacker News on 2026-10-28) describing an unreleased internal research model that autonomously discovered vulnerabilities and produced working exploits that can be run and verified. The work followed a 90-day vendor patch window plus a 45-day embargo before public discussion, and every flaw was patched before publication.

Chrome (macOS): a chain of four flaws starting from V8 heap memory corruption, an ASLR defeat via sandbox escape, a CacheStorage race condition used to leak the browser process memory layout, and a FedCM use-after-free to gain code execution outside the sandbox (the PoC launches Calculator without user interaction). Anthropic reports 62 CVEs assigned, all critical or high, including 13 sandbox escapes and 21 renderer vulnerabilities, patched in Chrome 156 (stable 2026-10-20). Individual Chrome CVE IDs are not listed in the sources reviewed.

Safari (iOS/iPadOS): a JavaScriptCore use-after-free in TypedArray operations, a Gigacage isolation bypass, and a WebContent sandbox IPC flaw give access to disk-stored history, cookies and sessions; a memory overwrite then disables the same-origin policy, enabling cross-site data theft as a data-only attack with no arbitrary code execution. Patched in iOS/iPadOS 26.5.2 (June 29) per the news report; individual CVE IDs are not listed.

Android: a USB authorization bypass chain (device-transfer protocol authorization check circumvention, skipped authenticated key-agreement verification of a 6-digit code, and a hardcoded USB transfer check bypassed via a fallback mechanism) extracts photos and personal data from a locked Pixel 9. Google reportedly fixed it; no public record or CVE ID was found.

Windows: CVE-2026-33096 (CWE-125, CVSS 7.5) is an unauthenticated remote out-of-bounds read in HTTP.sys (kernel QUIC handling, reachable over HTTP/3) that crashes or restarts the host; repeated requests sustain denial of service. Publicly disclosed 2026-04-14 and patched by Microsoft.

Linux: CVE-2026-98432 is a race-condition use-after-free in the kernel networking stack (Wiz describes it as an IPv4 TCP inet_opt/ireq_opt UAF, CWE-416, CVSS 8.1, introduced in 4.4 by commit 079096f103fa; Anthropic reports exploitation against multipath TCP listeners). The chain races to cause a kernel pointer overread defeating KASLR (about 48 minutes), then a buffer overflow overwrites a callback pointer and a ROP chain runs arbitrary commands as root (about 5 additional minutes). The hunt skeleton cited CVSS 9.8; the independently found Wiz record shows 8.1, so 8.1 is used here. Fixed in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7 (upstream commit e3f33b0a1d89d738e2b913dab519226eaf76e15b). No public PoC, in-the-wild exploitation or CISA KEV entry was reported as of 2026-10-15.

The significance for defenders is the demonstrated speed and low human involvement of AI-driven exploit development, which shortens the time between patch release and weaponization. No threat actor, malware, C2 infrastructure or network IOCs are attributed. IOC entries below are defensive indicators and components derived from the sources, not adversary infrastructure.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1461 Lockscreen Bypass
- T1203 Exploitation for Client Execution
- T1212 Exploitation for Credential Access
- T1539 Steal Web Session Cookie
- T1005 Data from Local System

## Sources

- [Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits](https://thehackernews.com/2026/10/anthropics-unreleased-ai-model-chains.html)
- [Anthropic: Discovering Vulnerabilities with Claude](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude)
- [Wiz Vulnerability Database: CVE-2026-98432](https://www.wiz.io/vulnerability-database/cve/cve-2026-98432)
- [Wiz Vulnerability Database: CVE-2026-33096](https://www.wiz.io/vulnerability-database/cve/cve-2026-33096)
- [NVD: CVE-2026-33096](https://nvd.nist.gov/vuln/detail/CVE-2026-33096)
- [Microsoft MSRC: CVE-2026-33096 HTTP.sys Denial of Service](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33096)
- [CraftedSignal brief: HTTP.sys DoS (CVE-2026-33096) with Sigma detections](https://feed.craftedsignal.io/briefs/2026-04-http-sys-dos/)
- [Chrome 156 security update](https://securityonline.info/chrome-156-security-update/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4624