Anthropic says an unreleased Claude model built working exploit chains for Chrome, Safari, Android, Windows and Linux

Anthropic's Frontier Red Team published a report on October 27, 2026 describing how an internal research model, which the company has not released or named, discovered software vulnerabilities and combined them into five working proof-of-concept exploits. Anthropic says all the flaws were disclosed to the affected vendors before publication.

The five chains

In Chrome on macOS, the model linked four bugs, starting with memory corruption in the V8 JavaScript engine and ending with a use-after-free in the FedCM component, to run code outside the browser sandbox after a single page visit. Across its Chrome work, Anthropic says 62 CVEs had been assigned and patched as of Chrome 156. In Safari, a chain that runs no code of its own corrupts browser memory to switch off the same-origin policy, letting a malicious page read data from other sites where the user is logged in. On Android, three flaws tested on a Pixel 9 allowed photos and personal data to be copied over USB from a locked phone. On Windows, an out-of-bounds read in the kernel's QUIC code lets a remote attacker repeatedly crash servers that answer HTTP/3 with a handful of packets. On Linux, a race condition in multipath TCP gives a remote attacker a root shell without credentials; the proof of concept needed about 48 minutes to leak a kernel address and roughly five more to get the shell.

Anthropic says it follows a 90-day patch window, plus 45 days before discussing details beyond a public advisory. Alongside the report, it promoted an expanded Cyber Verification Program that gives vetted security professionals access to more permissive cyber capabilities.

What can and cannot be checked

The Hacker News, reviewing public records, found that Apple and Google credit Anthropic researchers working with Claude for specific fixes, which supports parts of the account. It also flagged gaps. The Windows bug, CVE-2026-33096, is described in its CVE record as an HTTP.sys issue rather than a kernel QUIC flaw, and credits no finder. The Linux record, CVE-2026-98432, describes an IPv4 TCP fix, not multipath TCP; only Anthropic's post connects the two. The outlet found no public record of the Android fix. Anthropic also does not say how much human effort went into each stage, so the degree of autonomy cannot be independently assessed.

Why it matters

AI models are no longer just flagging bugs: they can assemble multi-step attacks. Anthropic presents this as a reason to scan code earlier, at pull-request time, though the same capability carries an obvious risk of misuse.