Anthropic says an unreleased internal research model built working exploit chains against Chrome, Safari, Android, Windows and Linux, turning individual bugs into lab attacks that ran code, pulled private data or knocked servers offline. The company's Frontier Red Team published the results on October 27 and said every flaw was reported to its vendor before disclosure, with fixes now shipped.
The Chrome result is the headline. The model chained four flaws into a one-click remote code execution attack: a V8 heap-corruption bug, a second V8 bug that escaped the engine's memory sandbox and defeated ASLR, a CacheStorage race condition that exposed the browser process's memory layout, and a use-after-free in FedCM that completed the escape. The proof of concept launched Calculator from stock Chrome on macOS after a single page load.
Anthropic said Google assigned 62 CVEs from its reports, all rated critical or high, including 13 sandbox escapes and 21 renderer-compromise bugs, and that all are patched as of Chrome 156. Google's Chrome 156 release notes, dated October 20, credit "Xinyang Ge (Anthropic), assisted by Claude" for several fixes. A tally of the last three Chrome releases found 23 critical or high fixes carrying Anthropic's or Claude's name, short of the 62 Anthropic cites.
Key facts
- 01Anthropic's Frontier Red Team says an unreleased internal Claude model built exploit chains for Chrome, Safari, Android, Windows and Linux.
- 02The Chrome chain linked four flaws into one-click code execution; Google assigned 62 CVEs from Anthropic's reports, all fixed in Chrome 156.
- 03The Linux exploit gave remote root via multipath TCP: a 48-minute KASLR leak, then a shell five minutes later (CVE-2026-98432, rated 9.8).
- 04Anthropic gives vendors 90 days to patch plus 45 more days before discussing details beyond a public advisory.
- 05An expanded Cyber Verification Program offers vetted defenders Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1 with reduced blocking classifiers.
The Safari chain is a data-only attack with no arbitrary code execution. It starts with a use-after-free in JavaScriptCore, bypasses Gigacage isolation, then uses an IPC weakness in the WebContent sandbox to read stored history, cookies and session data before disabling the same-origin policy. Anthropic said Apple acknowledged the report the same day, and Apple's iOS and iPadOS 26.5.2 notes from June 29 credit Anthropic researchers Milad Nasr and Nicholas Carlini, working with Claude, for the fix.
On Android, the model extracted photos and personal data from a locked Pixel 9 over USB. It chained three flaws: one bypassed the rule that locked phones don't transfer data over USB, one skipped the authorization check in the device-to-device transfer protocol, and one skipped verification of the six-digit pairing code. A fallback path then sent raw file bytes past a hardcoded block. Anthropic says Google has fixed the issue, though no public Google record of the fix has surfaced.
The Windows finding is a remote denial of service. Claude found a kernel out-of-bounds read in the native Windows QUIC implementation for HTTP/3 through binary analysis with tools such as Ghidra, and a few packets can crash and restart an affected machine. Anthropic estimates several million listening servers could be exposed. Microsoft fixed it in April as CVE-2026-33096, rated 7.5, though the public CVE record names the HTTP.sys driver rather than the QUIC component Anthropic describes.
The Linux exploit is the most severe. A race-induced use-after-free in the kernel's multipath TCP code lets a remote attacker run commands as root with no credentials and no user action. In the proof of concept, defeating KASLR took 48 minutes and reaching command execution took five more, and failed races only fail the handshake, so an attacker can keep retrying. Anthropic ties the bug to CVE-2026-98432, rated 9.8 and patched upstream and in maintained stable branches; the CVE record itself describes an IPv4 TCP fix, so the multipath link rests on Anthropic's post.
Anthropic said it found the bugs by running many scanning agents in parallel, measuring each by its unique contribution, and running automated variant analysis on confirmed findings. The company said the chains came "after initial prompting" and with "little human involvement," without breaking down the human work at each step. The team also reported local privilege escalation bugs in OpenBSD, FreeBSD and Linux, plus sandbox escapes and web application flaws.
Reports followed Anthropic's coordinated disclosure policy, which gives vendors 90 days to patch and then waits a further 45 days before discussing details beyond a public advisory. Alongside the research, Anthropic expanded its Cyber Verification Program, which gives qualifying security professionals access to Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1 with reduced blocking classifiers, and released a Claude Code security plugin for scanning at pull-request time.
Anthropic has not named the model or said whether it will be released. "Our advice to defenders remains the same: scanning your own code is more important than ever," the Frontier Red Team wrote.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
