Reverse engineering Claude's CVE-2026-2796 exploit

This report analyzes CVE-2026-2796, a Firefox WebAssembly JIT miscompilation that allowed type confusion by unwrapping Function.prototype.call.bind wrappers, and documents how Anthropic’s Claude Opus 4.6 autonomously developed an exploit in a stripped js shell—using addrof/fakeobj primitives and WasmGC struct.get/struct.set for arbitrary read/write—to achieve code execution; the bug is now patched but the case highlights rapidly improving LLM-assisted exploit capabilities.