Skip to content
NewsResearch

Anthropic's unreleased research model built five working exploit chains across Chrome, Safari, Android, Windows, and Linux

· by

The short version

Anthropic's Frontier Red Team used an unreleased internal model to chain 62 Chrome CVEs into a one-click exploit and a Linux kernel bug into a zero-click root shell, publishing all five chains on October 27, 2026 after every vendor had already patched.

Anthropic's unreleased research model built five working exploit chains across Chrome, Safari, Android, Windows, and Linux

An unreleased Claude research model turned a single Chrome bug into a chain of 62 CVEs that launches Calculator on a stock Mac within seconds of loading a web page, per Anthropic's Frontier Red Team. Anthropic published that chain and four others on October 27, 2026, each one starting from a human prompt rather than open-ended autonomy, and only after Google, Apple, and Microsoft had already shipped fixes. Worth flagging up front: Anthropic frames this as proof that defenders need the same offensive capability attackers will eventually get, which doubles as a vendor argument for why Anthropic should be the company holding the most capable models. Nobody outside Anthropic has run this comparison, and no rival lab has published a similar before-and-after on its own model.

What

Anthropic's post describes five attack chains built with an internal research model the company has not released publicly, choosing Chrome, Safari, Android, Windows, and Linux as targets because together they sit under billions of devices. The two that matter most to a Chrome-and-Linux audience: the Chrome chain combined a V8 heap-corruption bug, a CacheStorage race condition that defeated ASLR, and a use-after-free in the FedCM sign-in feature; Google assigned 62 CVEs and patched them in Chrome 156, including 13 sandbox escapes and 21 bugs that could compromise the renderer process on their own. On Linux, a race-condition use-after-free in the kernel's networking stack produced a zero-click, unauthenticated root shell: the proof of concept needed 48 minutes to leak a kernel pointer and five more to execute code, a chain now tracked as CVE-2026-98432 and backported to every maintained stable kernel. The other three, briefly: a Safari chain abused WebKit's Gigacage memory isolation and a WebContent sandbox IPC flaw to read a signed-in user's email or bank balance with no code execution required, and Apple shipped a fix the same day it received the report; an Android chain combined source review, reverse-engineered Play Services binaries, and live testing on a physical Pixel 9 to pull photos off a locked, stolen phone without unlocking it, which Google has since addressed; and a Windows chain found an out-of-bounds read in the kernel's QUIC implementation that crashes any machine answering HTTP/3 requests, assigned CVE-2026-33096, with Anthropic estimating several million servers were reachable this way before Microsoft's patch. Anthropic says the same work also turned up privilege-escalation bugs in OpenBSD and FreeBSD and multiple sandbox escapes elsewhere, though the post details only the Linux case.

Context and reactions

Anthropic's own coordinated vulnerability disclosure policy gives an affected vendor 90 days to patch and another 45 days before Anthropic discusses details beyond what a public advisory already covers, which is why every chain in this post maps to a CVE that was fixed before publication. The company drew an explicit contrast to a separate finding from five weeks earlier: a September 29 Frontier Red Team post on GLM-5.3, a rival model Anthropic said has comparable autonomous exploit-building ability but shipped, in Anthropic's words, "without meaningful safeguards to limit misuse." The exploit-chain post is also the fifth Frontier Red Team publication in October alone, following pieces on formal software verification, attack-surface reduction, and a cryptography history post on ECDSA curve origins, which points to a team publishing on a near-weekly cadence rather than a one-off release. None of the five chains described here have been observed outside Anthropic's own test environment, and the company has not published the model's name, size, or release timeline.

The actionable part: a free scanning plugin

Google, Apple, and Microsoft have confirmed and patched the specific bugs Anthropic reported, but none of the three companies has published its own account of how the model found them. What a reader can act on today is the tooling Anthropic built to do this work: a platform that runs many scanning agents in parallel against a codebase, scores each one by how many additional vulnerabilities it turns up, and tracks coverage so the fleet keeps moving rather than re-checking the same functions, released as a Claude Code plugin for pull-request-time scanning that's free for any developer to install. Anthropic also expanded its Cyber Verification Program, giving vetted security professionals access to Opus 5.5, Sonnet 5.5, and Mythos 5.1 with fewer of the usual blocking classifiers. For a team running Chrome-adjacent or Linux-adjacent code, installing the security-guidance plugin and pointing it at an open pull request is the one move here that doesn't require waiting on Anthropic, a vendor, or an independent researcher to confirm anything first.

Sources