News / Industry
An unreleased AI model found and chained real exploits across browsers and operating systems
Anthropic says an unreleased internal Claude model chained working exploits across Chrome, Safari, Android, Windows and Linux. Vendors have since patched.
On October 27, 2026, Anthropic published an unusual result. A single unreleased research model, one the company has not shipped and did not name, found software flaws and assembled them into working proof of concept exploits across five platforms at once: Chrome, Safari, Android, Windows and Linux. Those are not fringe targets. They are the browsers and operating systems that run most of the world's phones, laptops and servers.
The claim matters less for any single bug than for the pattern. Finding a flaw is routine work. Turning several flaws into a reliable, end to end exploit, and doing it on systems built by different vendors with different defenses, is the slow and costly part of offensive security. According to Anthropic's own writeup, that is the part the model did.
| Field | Detail |
|---|---|
| Who | Anthropic, Frontier Red Team |
| When | Reported October 27, 2026 |
| What | One unreleased, internal Claude research model |
| Platforms | Chrome, Safari, Android, Windows, Linux |
| Status | Reported under coordinated disclosure; vendors have shipped fixes |
What happened
Anthropic described the system plainly as an "unreleased, internal research model," run by its red team to test how far current models can push vulnerability research. The company said it reported every issue through coordinated disclosure and that the affected vendors have since patched them.
The writeup is specific about the work. On Chrome, the model produced a one-click chain that ran the Calculator app outside the browser sandbox, combining a V8 heap corruption bug, a sandbox escape that defeated address space layout randomization, a cache race to read browser-process memory, and a use-after-free for code execution. On Linux, it built a zero-click chain that reached root on a server running a multipath TCP listener. Anthropic says the flaws it reported led to fixes from Google, Apple, Microsoft and the Linux kernel maintainers.
The expensive part of an attack, turning a pile of separate bugs into one working chain across different systems, is the part a machine just did.
The five chains
Each chain targeted a different layer of the stack, and each has limits worth stating plainly.
Android. The model chained three flaws to pull photos off a locked Google Pixel 9. It is a real lock screen bypass, but it needed physical access over USB, so it is an attack on a device already in someone else's hands, not a remote one.
Linux. The strongest result: a zero-click, remote chain that used a race-condition use-after-free in the kernel networking stack to leak a kernel pointer and then hijack control flow, reaching root on servers with a multipath TCP listener enabled. Anthropic frames it as a proof of concept, and notes that a lost race only fails the connection, so an attacker can retry. The fix is tracked as CVE-2026-98432.
Windows. A remote denial of service against machines running the native HTTP/3 implementation. An out-of-bounds read in the kernel's QUIC code crashes and restarts the machine. It cannot run code or read data, so the impact is downtime, not theft. Anthropic noted that the hard part here was "identifying the vulnerability in the first place." Microsoft resolved it as CVE-2026-33096.
Chrome. The browser chain linked several bugs, reported as around four, to break out of the sandbox on macOS in a default configuration. Anthropic's broader Chrome work, it says, led Google to assign and fix 62 CVEs as of Chrome 156.
Safari. A chain that bypassed the same-origin policy, the rule that stops one website from reading another's data, to reach browser history, cookies and session data. Anthropic calls it a data-only attack that never runs arbitrary code, and notes that several of the Safari weaknesses are intended behaviors that become dangerous only in combination.
The caveats
The numbers deserve the same care. The figure of 62 Chrome issues is Anthropic's own aggregate of the work, not a tally that outside researchers have independently mapped to each public vulnerability record, and some outlet accounts of the details disagree. Vendor advisories confirm the underlying bugs were real and are fixed, which is the load-bearing fact. Whether one model stitched all five chains together as cleanly as described is, for now, something only Anthropic can show.
What it means for defenders
Strip away the model and the uncomfortable part remains. The step that has long gated serious offensive work, chaining individual bugs into a dependable exploit across unlike systems, is now something software can attempt at speed. That lowers the cost of the hardest stage of an attack, and cost is most of what has kept this kind of work rare.
The same capability points the other way. AI-assisted bug hunting already has a defensive track record. In November 2024, Google's Big Sleep agent found an exploitable memory-safety bug in SQLite that fuzzing had missed, and the project patched it before it ever shipped; the team called it the first public case of an AI agent finding a previously unknown exploitable flaw in widely used software. In 2025, the systems in DARPA's AI Cyber Challenge found and patched vulnerabilities in real code automatically, with Team Atlanta taking the top prize at DEF CON.
For defenders, the practical lesson is older than any of this and only sharper now. When an attacker, human or machine, can combine ordinary bugs into a working route to real data, the unit of risk is the path, not the isolated finding. Ranking a flaw by its attack surface versus its attack path, and fixing the step that breaks the most chains, is the discipline this news rewards. And the argument for building security to be AI-native, designed around AI-assisted offense rather than surprised by it, gets a little harder to wave off each time a result like this lands.