Anthropic's Frontier Red Team says an unreleased internal model turned five separate vulnerability chains into working proof-of-concept exploits across Chrome, Safari, Android, Windows and Linux — in the lab, under prompting, with every flaw reported to the vendor before publication. One proof of concept opened the Calculator app on a stock Mac running Chrome within seconds of a page loading, with no further clicks.
The company's framing is deliberate: the achievement worth worrying about is not any single bug, but that one model found several separate flaws and combined them into something a person could run.
What each chain would have done
- Chrome: code execution outside the browser sandbox from a single page load. Four flaws in sequence — a memory corruption in V8, a V8 sandbox escape, a race condition in CacheStorage that leaked the browser process's memory layout, and a use-after-free in FedCM to run outside the sandbox. Fixed in Chrome 156 on 20 October. Anthropic says it reported 62 flaws to Google, all critical or high, 13 of them sandbox escapes. - Safari: full read and write access to the browser's memory, then a single value flipped to disable the same-origin policy, so a malicious page could read a signed-in user's other sites and send requests on their behalf. Fixed in iOS and iPadOS 26.5.2 on 29 June. - Android: extraction of photos and other data from a locked, stolen handset over USB. Anthropic says Google fixed it; The Hacker News found no public record. - Windows: a remote denial of service against servers answering HTTP/3. Tied to CVE-2026-33096, patched April 2026 and rated 7.5. - Linux: commands as root over the network, with no login and no user action, against a server running a multipath TCP listener. Anthropic says its proof of concept took 48 minutes to leak a kernel address and five more to reach a shell, and that a failed attempt does not crash the machine, so it can be retried. CVE-2026-98432, rated 9.8, fixed upstream on 15 October.
The part you cannot check
Apple and Google credit Anthropic researchers, with model assistance, in their own release notes — "Milad Nasr and Nicholas Carlini with Claude, Anthropic" for the Safari fix, "Xinyang Ge of Anthropic, assisted by Claude" for specific Chrome fixes. That corroborates the discovery half of the claim.
What no public record shows is how much of each chain the model built alone. Anthropic says the work needed only "initial prompting" and "little human involvement"; it does not break down what a person did at each step and does not name the model beyond calling it an unreleased internal research model. Two of the five CVE attributions sit awkwardly against their records: the Windows advisory names HTTP.sys rather than QUIC handling and credits no finder at all, and the Linux CVE describes an IPv4 TCP fix rather than multipath TCP. Those links rest on Anthropic's post alone.
The capability claim is also inherently hard to audit: no defender can re-run it against unpatched targets, because the targets are patched.
Why Anthropic published
The team points to coordinated disclosure — 90 days to patch, 45 more before discussing details beyond the advisory — and to a defensive motive. "Now, it's something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify," the post says.
Vetted security professionals get access to the work through an expanded Cyber Verification Program covering Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1. That gating is the honest signal about where this capability sits: behind an invitation, not behind a paywall.
The uncomfortable arithmetic is that a 90-day clock and a model that writes exploit chains serve whoever is on either side of the disclosure. Four of the five flaws are already public and patched; the fifth is public in the sense that matters — someone wrote it down.
