An unreleased artificial intelligence model from Anthropic discovered security vulnerabilities across Chrome, Safari, Android, Windows, and Linux, then combined them into functioning proof-of-concept exploits, the company reported. The exploits were created in a lab setting after researchers prompted the model, never appeared in actual attacks, and Anthropic disclosed every vulnerability to vendors before publication, meaning all have been patched. One demonstration launched the Calculator app on a stock Mac running Chrome within seconds of a page loading, requiring no additional clicks. The company's Frontier Red Team documented five separate exploit chains, with the central claim being that a single model identified multiple independent flaws and linked them into working exploits, work that has historically required specialized human teams.

The Chrome chain used four separate vulnerabilities in sequence: a malicious page first corrupted memory in V8, Chrome's JavaScript engine, then a second flaw escaped V8's memory sandbox and seized control of the page-rendering component. A race condition in CacheStorage allowed that code to read restricted memory and map the layout of the more privileged browser process, while a final use-after-free bug in FedCM, Chrome's sign-in feature, enabled code execution outside the sandbox entirely. Anthropic reported it disclosed 62 flaws to Google that received CVE assignments and were fixed as of Chrome 156, all rated critical or high severity, including 13 sandbox escapes. Google's release notes credit "Xinyang Ge of Anthropic, assisted by Claude" for specific Chrome fixes. The Safari chain never executed code but instead chained flaws to gain full read and write access to browser memory, then altered a single value to disable the same-origin policy, the rule preventing one website from reading another's data. With that protection removed, a malicious page could read a user's history and cookies and send authenticated requests to other sites. Apple fixed the use-after-free at the center of the chain in iOS and iPadOS 26.5.2 and credits "Milad Nasr and Nicholas Carlini with Claude, Anthropic" for the discovery. The Linux chain ran commands as root over the network without login, requiring the target server to run a multipath TCP listener. The model first leaked a kernel memory address to bypass a defense called KASLR, then exploited the same race-condition bug to redirect the program to attacker-placed code, resulting in a root shell. Anthropic's proof of concept took 48 minutes to leak the address and five more to obtain the shell, and failed attempts don't crash the system, allowing repeated tries. The company ties this chain to CVE-2026-98432, a kernel use-after-free rated 9.8 and fixed upstream on October 15.

The report states the model completed this work with "initial prompting" and "little human involvement," though it doesn't detail what tasks a person performed at each step and doesn't name the model beyond describing it as an unreleased, internal research model. According to Anthropic, the company reported each flaw under a coordinated disclosure policy that gives developers 90 days to patch and 45 more before discussing details beyond a public advisory. The strongest claim isn't any individual bug but that one model found several separate flaws and combined them into a working exploit, something the company says has until now been the work of a few specialist teams. What readers can verify are the patches themselves and the fact that Apple and Google credit Anthropic and its Claude model for specific fixes, but what remains unverifiable is how much of each chain the model built independently.

Anthropic frames the work as assistance for defenders and points security teams to its expanded Cyber Verification Program, which gives vetted professionals access to Claude Opus 5.5, Sonnet 5.5, and Mythos 5.1. The company says it's publishing because "now, it's something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify." The Windows chain, a denial-of-service attack that crashes a machine with a few network packets and keeps it down by repeating them, is the narrowest in scope, running no code and stealing no data. The Android chain copies photos and other data off a locked, stolen phone given physical access over USB, and Google has fixed it, though no public record was found. Anthropic's authorship of the Windows vulnerability, CVE-2026-33096, rests on its own post, as the CVE record credits no finder and the U.S. government's vulnerability enrichment marked the flaw as not exploited as of late October, with no entry in the CISA catalog of known exploited bugs. The question now shifts from whether models can chain exploits to how quickly offensive capabilities will spread beyond vetted research programs, and whether patching cycles can keep pace when discovery no longer depends on scarce human expertise.