Threat Advisory: AI-Generated Zero-Day Exploit Chains

Download the full advisory (PDF): vulnerability details, attack requirements, Linux distribution status and a recommended action checklist. Status as of October 30, 2026.

Bottom line

On October 27, 2026, Anthropic’s Frontier Red Team published five attack chains that an unreleased internal AI model found and turned into working exploits against Chrome, Safari, Android, Windows and Linux. Four are fixed by their vendors. The Linux zero-click remote root chain (CVE-2026-98432) is fixed upstream, but as of October 30 there is no fixed kernel from Ubuntu or Red Hat.

• Browsers and Apple devices: patched. Chrome 156 and Apple’s fix are out; the work is confirming deployment, including other Chromium-based browsers.
• Windows: patched since April 14, 2026. The impact is loss of availability, not code execution.
• Linux: fixed upstream, not yet in Ubuntu or RHEL kernels, with no vendor-endorsed mitigation.

None of the sources we reviewed reports exploitation in the wild. What’s new is the capability: an AI model finding flaws and chaining them into working exploits. That claim is self-reported, but it suggests the window between a fix and a working exploit may keep shrinking.

What to do now

• Update Chrome to 156.0.8078.73 or later, and confirm other Chromium-based browsers have shipped their fixes.
• Update iPhones and iPads to 26.5.2 or later and apply Apple’s corresponding macOS updates.
• Confirm the April 14, 2026 Windows updates on internet-facing servers that answer HTTP/3.
• Inventory Linux servers by distribution, kernel and internet exposure. Apply fixed kernels where available (Debian, Oracle UEK, most SUSE releases and some Amazon Linux packages) and reboot into them; limit exposure where no fix exists yet.
• Revisit patch timelines for browsers, Apple devices and internet-facing servers.

The full advisory covers each chain in detail, what’s confirmed versus unverified, and the status of each Linux distribution.

Not sure whether you’re exposed? Talk to our team.