Anthropic says an unreleased model built five working exploit chains, now patched

Anthropic published details of five attack chains that it said an “unreleased, internal research model” had written over the preceding months, against widely used browsers and operating systems. The post does not name the model. In each case, Anthropic said, Claude produced the exploit after initial prompting, and the affected vendors have since fixed the flaws.

The five chains, as Anthropic described them:

• Chrome. A one-click chain through V8, a CacheStorage race condition and a use-after-free in FedCM that runs code outside the browser sandbox; the proof of concept opens the Calculator app on macOS. Anthropic said Google has assigned 62 CVEs, all rated critical or high, patched as of Chrome 156, including 13 sandbox escapes.
• Safari. A chain that lets any website bypass the same-origin policy and read history, cookies and logged-in sessions. Apple acknowledged the report the same day, Anthropic said, and has shipped a fix.
• Android. A lock-screen bypass, demonstrated on a physical Pixel 9, that extracts photos and personal data from a locked phone by chaining three flaws. Google has addressed it.
• Windows. A remote denial of service in the kernel’s QUIC implementation, found by reverse-engineering the binary, which Microsoft resolved as CVE-2026-33096. Anthropic estimated that “likely several million” servers listen for such traffic.
• Linux. A zero-click chain through a multipath TCP race condition (CVE-2026-98432) that gives a remote attacker root. In the proof of concept it took 48 minutes to leak a kernel pointer and five more to run a command. It was patched upstream and backported to all maintained stable kernel branches.

Anthropic reported all of them under its coordinated disclosure policy, which gives vendors 90 days to patch and a further 45 before it discusses details beyond the public advisory. The account of what the model did is Anthropic’s own. The Apple advisory that the post links credits a WebKit use-after-free, CVE-2026-43715, to “Milad Nasr and Nicholas Carlini with Claude, Anthropic”, and describes the impact only as memory corruption from malicious web content. Anthropic’s post gives no CVE for the Safari chain, so whether this is the same flaw is not confirmed.

The company drew two lessons. Running many scanning agents in parallel, with different strategies, found more vulnerabilities than a single pass. And fixing the backlog was only half the problem, so it recommended scanning at pull-request time and released a Claude Code security-guidance plugin. It also said it had widened its Cyber Verification Program, giving qualifying security professionals access to models including Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1 with fewer blocking classifiers.

The post follows Anthropic’s earlier Glasswing results, XBOW’s Chrome chain built with an OpenAI model and, the next day, Google’s release of Gemini 4 Carbon to cyber defenders. Anthropic’s stated conclusion was that combining several vulnerabilities into a working exploit, historically the work of a few specialist teams, is now something models can do with little human involvement.