Anthropic's unreleased internal model produced five attack chains: 62 CVEs in Chrome, a full same-origin-policy bypass in Safari, and zero-click root on Linux

The source. The primary material is one post on Anthropic's research blog, Discovering and exploiting vulnerabilities in critical, real-world software with Claude, credited to the Frontier Red Team and published in late October 2026. Every vulnerability, chain and number below comes from that post. One thing is worth stating up front: this is a vendor's own disclosure, so the chain details are Anthropic's account alone. The CVE identifiers, the vendor fixes and the upstream backports are third-party facts that can be checked separately. Those two kinds of evidence carry different weight and should be read separately.

Chain one: one-click remote code execution in Chrome, in four steps. First, the model found a heap corruption bug in V8 that lets a malicious page corrupt V8's heap memory. Second, it found another bug to escape V8's memory-region sandbox and defeat ASLR, locating Chrome in memory and using a return-oriented programming chain to take full control of the renderer process. Third, the compromised renderer was still confined by the process sandbox, so the model found a race condition in CacheStorage to read memory outside the sandbox and learn the layout of the privileged browser process. Fourth, it found a use-after-free in FedCM, Chrome's federated sign-in feature, to move code execution outside the sandbox. The stated proof of concept launches Calculator on a stock, default-configuration Chrome for macOS within seconds of the page loading, with no user action at all.

The output of that chain is checkable: Google assigned and patched 62 CVEs as of Chrome 156, all rated critical or high, 13 of them sandbox escapes and 21 capable of compromising the renderer. Chrome's stable channel update for that version is dated October 20, 2026, and Anthropic cites it as the anchor. Those 62 identifiers are the hardest evidence in the whole disclosure, because Anthropic did not count them, Google assigned them. You can argue about how well the chains are written; you cannot argue that the IDs exist.

Chain two: a wholesale bypass of Safari's same-origin policy. That policy is the foundation of the browser, so bypassing it means any website can read your data from other sites where you are signed in. The chain's notable property is that it is a data-only attack: it never needs arbitrary code execution, only full read and write access to the browser process's memory to change a security flag, an object size and a URL. The path: a use-after-free on TypedArray operations in JavaScriptCore writes through pointers to freed memory; WebKit's Gigacage normally isolates TypedArray data in a separate region, and the model found that certain variables in that region indexed into other regions, yielding arbitrary read and write outside the Gigacage; a flaw in the WebContent sandbox's IPC mechanism then read stored history, cookies and session databases from disk; finally the same use-after-free overwrote a variable to disable the policy. Apple acknowledged the report the same day and shipped a fix, which is documented on its support site.

Chain three: an Android lock-screen bypass. The scenario is concrete, a stolen phone whose photos and personal data can be pulled without unlocking it. As a piece of work this case says more about what the model was doing than the first two: part source-code analysis of the open-source components, part reverse engineering and deobfuscation of the Google Play services binaries, part live testing on a physical Pixel 9. Three vulnerabilities were chained to defeat four layers: a USB host with a specific setting bypasses the rule that a locked phone does not transfer data; the device-to-device transfer protocol's authorisation check is skipped so pairing starts; a flaw in the six-digit verification step makes the system behave as if the user tapped Allow; and a raw-byte fallback path not covered by a hardcoded check is used to request file contents. Google has addressed the issue, per Anthropic.

Chains four and five: remote denial of service on Windows and zero-click root on Linux. The Windows bug is an out-of-bounds read in the kernel's QUIC implementation, tracked as CVE-2026-33096. An attacker reaches it over the network and sends a few packets to a listening server to crash and restart the machine; repeat it and the service never comes back. Anthropic estimates there are likely several million such servers listening on the internet. The discovery process is worth noting: the model was given a copy of a Windows executable and asked to work out how the software works using existing reverse-engineering tools such as Ghidra, write a fully annotated C program reproducing the relevant features, verify the reproduction against the binary's behaviour, and then study the code for flaws. Asked to surface higher-risk issues, it returned this remotely exploitable one.

The Linux one is worse: CVE-2026-98432, a race-condition-induced use-after-free in multipath TCP that yields remote root with no credentials, no interaction and no clicks. Two stages. Stage one defeats KASLR remotely by exploiting the race so the kernel copies extra bytes back to the attacker according to an attacker-controlled length field; as long as one such over-read contains a kernel pointer, the address space layout is known. Stage two hijacks control flow, using the same use-after-free to overflow a buffer and overwrite a callback pointer with the address of a payload already staged in kernel memory via an ordinary protocol feature; when the kernel invokes the callback it chains existing kernel functions and ends with an attacker-chosen shell command running as root. The race has a nasty property: a lost race only fails the handshake without crashing the system, so an attacker can retry indefinitely. In the proof of concept, leaking the kernel pointer took 48 minutes and reaching the shell took five more. It is patched upstream and backported to all maintained stable kernel branches.

The method is more transferable than the results. Anthropic says it built a platform that runs large numbers of scanning agents in parallel, measures how many additional vulnerabilities each scanner contributes to the mix, and tracks coverage dynamically so the scanners process the whole codebase. Scanning strategies come in three layers: pure coverage, meaning is there a vulnerability in this function; goal-based, meaning does this app expose anything that could compromise customer data; and threat-model-based, meaning does anything bypass the threat model the app documents for itself. Every confirmed finding goes through automated variant analysis and a standardised verification and risk-rating pipeline. The second lesson is the practical one: clearing the backlog solves half the problem, and cutting the rate at which new vulnerabilities enter the codebase solves the other half, which is why they recommend scanning at pull-request time and have open-sourced a security-guidance plugin for Claude Code.

How to read the disclosure. First, the vulnerability and chain details are Anthropic's own account, delivered under coordinated disclosure: 90 days for vendors to patch, then another 45 before discussing anything beyond what is in a public advisory. That process is standard, and it is not third-party verification of the details. Second, what can be checked externally is this: the 62 CVE identifiers exist, Chrome 156's release note exists, Apple's patch page exists, CVE-2026-33096 is recorded in NVD, and the Linux bug was fixed upstream and backported. Those are facts and require trusting nobody's narrative. Third, and most important: once the capability is established, the defender's window gets shorter. A frontier model that can turn a browser into a four-step chain in a matter of days retires the assumption that exploits are too expensive to bother with, and the patching cadence has to move up.