Anthropic Says Unreleased Model Built Working Exploits for Chrome, Safari, Android, Windows and Linux. Vendors Have Patched

Since April, when Anthropic held back Claude Mythos Preview over its ability to find and exploit software flaws on its own, the company has been the loudest voice warning about AI-driven hacking. On Tuesday, Oct. 27, its Frontier Red Team put specifics behind the warning.

The team published five attack chains that it says an unreleased, internal research model found and exploited in Chrome, Safari, Android, Windows and Linux. Anthropic says the chains produced remote code execution and other critical impacts "with little to no user interaction."

Every flaw was reported to the vendor first. Anthropic's disclosure policy gives developers 90 days to patch, plus 45 more days before Anthropic discusses details beyond a public advisory. The fixes are out.

The five chains

Chrome. The model chained four flaws. It corrupted memory in V8, Chrome's JavaScript engine, then escaped V8's memory sandbox. A race condition in CacheStorage exposed the layout of the privileged browser process. A use-after-free bug in FedCM, Chrome's sign-in feature, finished the job by running code outside the sandbox.

Anthropic's proof of concept launches the Calculator app on a stock Chrome install on macOS within seconds of a page loading. No further clicks are needed.

Anthropic says it reported flaws that received 62 CVEs, all rated critical or high and all patched as of Chrome 156. Thirteen are sandbox escapes. Twenty-one could have been used to compromise the renderer.

Safari. This chain never executes attacker code. It uses full read and write access to the browser process's memory to change a security flag, an object size and a URL. That turns off the same-origin policy, the rule that stops one website from reading another's data.

Anthropic's example: a signed-in email account becomes readable, and a bank account's balances become visible to a malicious page. Apple fixed the use-after-free at the center of the chain in iOS and iPadOS 26.5.2 and credits "Milad Nasr and Nicholas Carlini with Claude, Anthropic."

Android. A lock screen bypass on the Pixel 9 that could extract photos and personal data from a locked, stolen phone. Anthropic says Google addressed it.

Windows. A remote denial of service in the kernel's QUIC stack that could crash any machine answering HTTP/3 requests. Microsoft fixed it under CVE-2026-33096. It is the narrowest of the five.

Linux. A zero-click remote code execution bug through multipath TCP, patched upstream under CVE-2026-98432. In Anthropic's proof of concept, the attack takes 48 minutes to leak a kernel pointer and about five more to run a shell command as root. A lost race fails the handshake instead of crashing the machine, so an attacker could keep retrying.

What can be checked and what can't

Some of this is verifiable with the vendors. Google's Chrome release notes credit "Xinyang Ge of Anthropic, assisted by Claude" for specific fixes. Those notes do not credit Anthropic for all 62. Apple's credit is on record. The Windows CVE is public, though the record names no finder.

What outsiders cannot check is the capability claim. Anthropic says each chain started with "initial prompting" and needed little human involvement. It has not published a step-by-step breakdown of what a person did, and it describes the model only as unreleased and internal.

Anthropic itself says the combination is the point. "Frontier models have the ability to discover and combine multiple vulnerabilities into a working exploit," the post says. "These skills have historically been the domain of few specialist teams."

There is also a data point on the other side. Google's Project Zero recently compared a classic fuzzer, Fuzzilli, against its BigSleep AI agent on V8 and found the two tied, with limited overlap in the bugs each found. That is one benchmark on one engine, not a rebuttal of Anthropic's chains. It does show AI tools and conventional ones finding different things.

The wider pattern

Anthropic is not alone in reporting this. OpenAI has called a newly announced PHP vulnerability "one of the most impactful security issues in recent memory" and said it expects similar findings "to increase sharply in the coming months." Greg Brockman, OpenAI's president, wrote that the PHP fix process was slow and manual in a way that would not scale. He suggested governments may need a far bigger role in monitoring internet infrastructure.

A chart compiled by the nonprofit Epoch AI shows major tech providers and open-source projects once reported a couple dozen critical vulnerabilities in a month. A typical month now sees about 600, according to that chart.

What Anthropic tells defenders

The post argues that clearing a backlog of old bugs is only half the job. "The other half is cutting the rate at which new vulnerabilities enter the codebase," it says. Its recommendation is to scan code at pull-request time, and it has released a Claude Code plugin for that purpose.

Its one-line advice: "scanning your own code is more important than ever." Stronger models go to vetted defenders through its Cyber Verification Program.

The open question is the one Anthropic has not answered: whether the model behind these chains will ever be released broadly, and under what controls. The company's 45-day window after patching, which allows fuller technical detail, will show how much of the work independent researchers can eventually reproduce.