Anthropic's unreleased model chained flaws into working exploits for Chrome, Safari, Windows, Linux and Android

An unreleased Anthropic model found security flaws in Chrome, Safari, Android, Windows and Linux and chained them into working proof-of-concept exploits, according to a research post from the company's Frontier Red Team reported by security outlets on Wednesday.

The exploits were built in the lab after the model was prompted, not observed in any real attack, and Anthropic reported every flaw to the relevant vendor first, so all of them are already patched.

One proof of concept opened the Calculator app on a stock Mac running Chrome within seconds of a page loading, with no further clicks. The Chrome chain used four flaws in sequence: memory corruption in V8, a sandbox escape that seized the renderer, a CacheStorage race condition that exposed memory and revealed the privileged process's layout, and a use-after-free in FedCM that ran code outside the sandbox entirely.

Anthropic says it reported 62 Chrome flaws that were assigned CVEs and fixed as of Chrome 156 on October 20, all rated critical or high, including 13 sandbox escapes. Google's release notes credit "Xinyang Ge of Anthropic, assisted by Claude" for specific fixes, though not for all 62.

The other chains differ in shape: the Safari bug let any website read data from sites the user was signed into, fixed in iOS and iPadOS 26.5.2; the Android chain copied photos and other data off a locked, stolen phone over USB; the Windows flaw crashed a server over HTTP/3 and kept it down, tracked as CVE-2026-33096; the Linux chain ran commands as root over the network with no login and no user action on servers running a multipath TCP listener, tracked as CVE-2026-98432.

The strongest claim is not any single bug but that one model found several separate flaws and combined them into a working exploit, work that Anthropic says had until now been the preserve of a few specialist teams.

That capability claim rests on Anthropic's own account. The report does not name the model beyond calling it an unreleased internal research model, does not break down what a person did at each step, and says only that the work needed "initial prompting" and "little human involvement". For the Windows bug, the public record names no finder at all.

What outside parties can check is the vendor side: the patches exist, and Apple and Google credit Anthropic and its Claude model for specific fixes, which lets researchers partly cross-check the timeline even if the division of labor between model and human stays opaque.

For defenders, the signal is that generating multi-bug exploit chains is getting cheaper. The practical response is to assume faster chaining of medium-severity flaws, and to read vendor capability narratives with the same skepticism applied to any other benchmark.