Tools AI-Found Vulnerability Register aifv-0123
Register entry
Windows HTTP/3 request handling can crash the server
- CVE
- CVE-2026-33096
- Project
- Microsoft Windows
- Component
- HTTP.sys / QUIC
- Finder
- Unreleased internal Claude research model
- Autonomy
- model-assisted research with human prompting and review
- Evidence tier
- Claim outside the record
- Assigner
- Microsoft
- Severity
- 7.5 High (CVSS 3.1)
- Confidence
- CONFIRMED
What happened
Anthropic attributes discovery of a Windows HTTP/3 memory-safety flaw to its unreleased research model, with human prompting and review.
Credit as recorded: null. Anthropic’s 27 October account describes remote denial of service against a Windows server responding to native HTTP/3 requests. Microsoft’s CVE was published on 14 April 2026; its later 15 October modification is a different date. Anthropic says it disclosed the issue to Microsoft and the fix is available. This is a vendor account of research, with no public model version. Date basis: Original CVE publication; explicit AI attribution on 27 October 2026.
Sources
- Anthropic original research account, 27 Octoberwww.anthropic.com/research/discovering-vulnerabilities-with-…
- Canonical CVE recordraw.githubusercontent.com/CVEProject/cvelistV5/main/cves/202…
- Maintainer advisorymsrc.microsoft.com/update-guide/vulnerability/CVE-2026-33096
One record from the AI-Found Vulnerability Register, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026