Zero Click Exploit

Anthropic's unreleased Claude model chains flaws into working exploits for Chrome, Safari, Android, Windows and Linux

Anthropic says an unreleased version of its Claude AI model discovered critical vulnerabilities in major browsers and operating systems and combined them into five functioning exploits, including a zero-click Linux root exploit, an Android data-theft attack on locked phones, and a Windows crash exploit. The company reported the flaws to affected vendors, who have since patched them, and published details in a blog post this week.

darkreading.com · 2026-10-29

Android bug lets a single SMS crash phone app and drop calls

Researcher Mark Blaszczyk disclosed a flaw in Android's telephony stack where a malformed WAP Push SMS causes an unchecked integer cast to produce a negative array size, triggering an uncaught exception that kills the com.android.phone process. The crash requires no interaction from the recipient and can terminate active calls, including emergency calls. Google classified the report as non-security and marked it won't fix, so no CVE was issued despite the 90-day disclosure window elapsing.

smsofdeath.com · 2026-10-29