Claude AI demonstrates exploits across major platforms, including linux root access in 53 minutes

Anthropic has revealed that its internal Claude model identified critical vulnerabilities across Chrome, Safari, Android, Windows, and Linux, with several exploited to create attack chains. On October 27, 2026, the company disclosed 62 high-severity CVEs in Chrome, including 13 sandbox escape flaws, and reported them to Google, which fixed them in Chrome 156. A proof-of-concept allowed Claude to launch the calculator app on macOS within seconds. On Android, the model could extract photos from a locked Pixel 9 via USB. The most severe vulnerability was a Linux flaw, CVE-2026-98432, which allowed root access without credentials in under 53 minutes. Microsoft had already patched a Windows vulnerability, CVE-2026-33096, in April 2026. Apple also addressed a Safari flaw that bypassed same-origin policies, enabling data theft from logged-in accounts.