An internal Claude model built five exploit chains; the disclosed flaws were patched before publication
Anthropic says its red team used an unreleased model to combine vulnerabilities across Chrome, Safari, Android, Windows and Linux. Vendor advisories confirm shipped fixes, but the programme was company-run and does not measure how often other models or attackers can repeat the work.
The short version
- What happened
- Anthropic reports five working chains covering Chrome, Safari, Android, Windows and Linux, including browser sandbox escapes and a zero-click Linux route to root command execution.
- Who it affects
- For people using mainstream browsers, phones and operating systems, the immediate action is ordinary but important: install supported security updates. For defenders, the programme suggests that vulnerability triage and patch cycles may need to keep pace with agent-assisted exploit development.
- What remains unproven
- Unreleased company model
Keep in mind
Unreleased company model
Company-selected examples and workflow
No target denominator or success rate
No matched model or expert comparison
No independent reproduction of the full chains
No evidence of exploitation in the wild
Disclosed vulnerabilities were patched before publication
Multi-source analysis · 3 linked sources. Primary analysed source date: 27 October 2026. Earliest linked supporting source: 20 October 2026.
Keep following the evidence
Join The Impact Brief founding list for selected AI reports, their effect on people and the evidence limits. Read a sample first.
Read the full report · 3 min The evidence, methods, implications and limitations
The chains crossed protections rather than stopping at one bug
Anthropic's Frontier Red Team says an unreleased internal model assembled five real exploit chains after being given reverse-engineering and testing tools. In Chrome, the reported route combined four flaws to corrupt memory, locate code, escape the renderer and execute outside the browser sandbox. A separate Safari chain bypassed same-origin protections to reach cookies, history and authenticated sessions. The Android demonstration extracted files from a locked Pixel 9 through a physical USB connection.
The two server cases were different. One Windows kernel flaw could remotely crash machines answering native HTTP/3 requests. A Linux multipath-TCP race could eventually run a command as root without credentials; Anthropic reports about 48 minutes to leak a kernel pointer and five more minutes to reach command execution in its proof of concept. Those are laboratory exploit timings, not observed attacks in the wild.[1][2][3]
Patches reduce immediate exposure; the capability claim still needs outside testing
Anthropic says all five chains were disclosed to vendors and fixed before the technical write-up. Google lists Chrome 156 as containing 353 security fixes and credits several Anthropic-assisted reports; Apple links a shipped security update. The company says the Linux fix was backported to maintained stable branches and Microsoft resolved the Windows issue. Readers and operators should update supported devices and servers rather than treat the disclosure as evidence of an active unpatched campaign.
The result nevertheless changes the defensive planning question: an agent did not merely flag suspicious code; it combined weaknesses across security layers into working proofs of concept. But Anthropic developed the model, operated the scanners and chose the examples. It does not publish a denominator of targets tested, failure rate, total compute, human intervention time or a matched comparison with other models. Independent reproduction and misuse telemetry would change the assessment.[1][2][3]
The distinction that matters
What the disclosure establishes
The programme connects model-assisted discovery to patched working chains, while leaving repeatability and prevalence unresolved.
Find
Run parallel scanners and reverse-engineering tools
Multiple candidate vulnerabilities
Chain
Combine bugs across protection layers
Five working proofs of concept
Disclose
Report privately before publication
Vendor fixes shipped; no active campaign shown
Continue the story
Read next
Continue exploring cybersecurity: compare the finding and its evidence limits.
An open model built Firefox file-theft exploits across six releases
Epoch AI says GLM 5.3 turned published-but-unshipped fixes into working file-theft pages for six Firefox versions. The key sandbox escape is patched in Firefox 159, and the study did not show arbitrary code execution or a current-version compromise.
Read the next reportExplore the full source and evidence record
What this means for people
- For people using mainstream browsers, phones and operating systems, the immediate action is ordinary but important: install supported security updates. For defenders, the programme suggests that vulnerability triage and patch cycles may need to keep pace with agent-assisted exploit development.
Global context
Browser and operating-system flaws affect globally distributed software, but update availability and adoption vary by vendor, device and support status. The disclosure concerns specific patched chains, not proof that every installation or product version was exploitable.
What the evidence does not yet show
- Unreleased company model
- Company-selected examples and workflow
- No target denominator or success rate
- No matched model or expert comparison
- No independent reproduction of the full chains
- No evidence of exploitation in the wild
- Disclosed vulnerabilities were patched before publication
What to watch next
- Independent reproduction under a controlled benchmark
- Full target and failure denominators
- Vendor patch adoption
- Evidence of related exploitation in the wild
- Defensive use in continuous integration
- Access controls around high-capability cyber models
Living evidence record
Impact record IAI-0AHL896
Evidence stage
Announced
Confidence
Supported
Reporting basis
Multi-source analysis
Independent or research support
Not yet
Record status
Monitoring
Last checked
28 October 2026
Source trail
3 direct sources across 1 source type.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Evidence trail
Sources used for this report
Links checked 28 October 2026
Research question, topics and regions
Whether a frontier model can discover and combine real software vulnerabilities into working multi-stage exploit chains under a company red-team programme
Topics: Cybersecurity · Vulnerability research · Browser security · Operating systems · AI agents · Coordinated disclosure
Regions: United States · Global
This report is labelled multi-source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.