"Now, it's something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify," Anthropic wrote in explaining why it published its findings.
Anthropic's Frontier Red Team: lab-built proofs, unreleased model, coordinated fixes
Anthropic's Frontier Red Team reported that an unreleased internal research model found security flaws in Chrome, Safari, Android, Windows and Linux, and chained several of those flaws into working proof-of-concept exploits in the lab. The company says the work followed its coordinated disclosure policy — it reported each flaw to vendors first — and that all of the reported issues are patched. Anthropic also says the model required only "initial prompting" and "little human involvement," but the post does not break down what a person did at each step and does not name the model beyond calling it unreleased.
One proof of concept Anthropic published opened the Calculator app on a stock Mac running Chrome within seconds of a page loading, with no further clicks. Anthropic frames the work as help for defenders and points security teams to an expanded Cyber Verification Program that gives vetted professionals access to Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1.
Chrome chain: four linked bugs, 62 reports, and partial credit
Anthropic described a Chrome chain that used four separate flaws in sequence. According to the company, a malicious page first corrupted memory in V8, Chrome's JavaScript engine. A second flaw escaped V8's memory sandbox and took control of the page-rendering component. A race condition in CacheStorage then let that code read memory it should not reach and learn the layout of the more privileged browser process. Finally, a use-after-free bug in FedCM, Chrome's sign-in feature, let the exploit run code outside the sandbox entirely.
Anthropic says it reported 62 flaws to Google that were assigned CVEs and fixed as of Chrome 156; the company characterizes all 62 as rated critical or high, including 13 sandbox escapes. Google's release notes credit "Xinyang Ge of Anthropic, assisted by Claude" for specific Chrome fixes, though not for all 62.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleSafari chain: memory writes that flip the same-origin rule; Apple credits researchers with Claude
The Safari chain did not execute native code, Anthropic reported. Instead it chained vulnerabilities to gain full read and write access to the browser's memory and then changed a single value to disable the same-origin policy — the rule that prevents one website from reading another site's data. With that policy turned off, a malicious page could read a user's history and cookies and send signed-in requests to other sites.
Apple fixed the use-after-free at the center of the chain in iOS and iPadOS 26.5.2 and credits "Milad Nasr and Nicholas Carlini with Claude, Anthropic" for the fix.
Windows and Linux chains: differing public records and high-severity kernel flaws
The Windows chain Anthropic describes is narrower and a denial-of-service: a few network packets crash the machine and repeating them keeps it down, but it does not run code or steal data. Anthropic characterizes the issue as an out-of-bounds read in the Windows kernel's QUIC handling. The public record it points to, CVE-2026-33096, instead names HTTP.sys, Windows' built-in web request handler, and rates the flaw 7.5 out of 10. That CVE credits no finder. As of late October the U.S. government's vulnerability enrichment marked the flaw as not exploited and it is not in the CISA catalog of known exploited bugs.
The Linux chain is the most consequential in impact: Anthropic says the exploit runs commands as root over the network without a login if the target server is running a multipath TCP listener. The model first leaks a kernel memory address to bypass KASLR, then reuses a race-condition bug to redirect the program to attacker-placed code, resulting in a root shell. Anthropic reports its proof-of-concept took 48 minutes to leak the address and five more to reach a shell, and that failed attempts do not crash the system so an attacker can retry.
Anthropic ties this chain to CVE-2026-98432, a kernel use-after-free rated 9.8 and fixed upstream on October 15. The public CVE record describes an IPv4 TCP fix rather than a multipath TCP item; the connection between those descriptions exists only in Anthropic's post.
What this means for security teams, vendors, and end users
- Security teams: Anthropic points defenders to its expanded Cyber Verification Program for vetted access to Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1; the company also stresses coordinated disclosure windows of 90 days plus 45 before broader discussion.
- Vendors and maintainers: Google and Apple have credited specific researchers and Anthropic/Claude in their release notes for fixes; several CVEs were assigned and patches deployed (Chrome 156; iOS and iPadOS 26.5.2; upstream kernel fix on October 15).
- End users and administrators: Anthropic says the exploits were built in the lab and not seen in real attacks, and vendors have released patches for the named fixes; the public record shows variation in attribution and technical description for at least two CVEs referenced by Anthropic.
Anthropic's report makes a consequential claim: that a single model found separate flaws and chained them into working exploits — a capability the company says was formerly the work of specialist human teams. That claim rests on Anthropic's account; Apple and Google independently credit specific fixes to named researchers and to "Claude" in their release notes. Two of the chains (Windows and Linux) map imperfectly onto public CVE descriptions, and Anthropic does not itemize what humans did at each step. Those details — how much of each chain the model built on its own, and how those public CVE records align with Anthropic's technical framing — are the concrete open points left by the company's post.
