Anthropic says unreleased Claude built Chrome, Android and Linux exploits
Vendors were notified first; Chrome 156 fixed 62 CVEs, and the Linux root flaw is CVE-2026-98432.
82
Vulnerability1 · 1 read
CVE-2026-33096
- CVSS 3.1
- 7.5 high
- EPSS
- 1%p68
- Published
- ·
- Modified
Description · NVD
Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.
- Vendors
- microsoft
- Products
- windows 11 23h2, windows 11 24h2, windows 11 25h2, windows 11 26h1, windows server 2022, windows server 2022 23h2, windows server 2025
- Weakness
- CWE-125
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
In the news
4 storiesGoogle unveils Gemini 4 Carbon with leading cyber benchmarks
Access is limited to some cyber defenders under Fairwind, and Google says it resisted every tested indirect prompt injection.
76
Unreleased Claude model wrote Chrome, Linux and Android exploit chains
Anthropic says the lab-only chains were reported first and fixed, including Chrome 156, with no real-world incidents.
74
Anthropic's unreleased model chained flaws into patched OS exploits
Lab proofs, not live attacks, covered Chrome 156, iOS 26.5.2, Windows CVE-2026-33096, and Linux CVE-2026-98432.
74