What happened
On 27 October 2026 Anthropic’s Frontier Red Team published a research post describing what it calls “five attack chains” built with an “unreleased, internal research model”. According to Anthropic, the chains led to remote code execution and other critical impacts “with little to no user interaction”. Anthropic says it reported the underlying flaws to the affected vendors before publishing. The model is not named in the post, and the results are Anthropic’s own account; they have not been independently reproduced.
Key details
- Chrome (macOS, stock Chrome): a one-click chain that runs code outside the browser sandbox, using a V8 heap corruption, a V8 sandbox escape, a CacheStorage race and a FedCM use-after-free. Anthropic says 62 CVEs from this work were assigned and patched as of Chrome 156, including 13 sandbox escapes and 21 renderer-compromise bugs, all rated critical or high.
- Safari: a one-click chain using a JavaScriptCore use-after-free, a Gigacage bypass and a WebContent sandbox IPC flaw, which bypasses the same-origin policy. Anthropic says Apple acknowledged the report the day it was submitted.
- Linux: a zero-click remote code execution chain through a race-condition use-after-free in the multipath TCP listener path (CVE-2026-98432). Anthropic says it takes 48 minutes to leak a kernel pointer and another five minutes to reach command execution.
- Windows: a remote denial-of-service in the kernel QUIC (HTTP/3) implementation (CVE-2026-33096). Anthropic estimates “several million such servers” listen on the internet.
- Android: a lock-screen bypass tested on a Google Pixel 9, which Anthropic says Google has addressed.
- Disclosure terms: Anthropic describes a 90-day window for patching plus 45 days before further technical details. The post also covers its Cyber Verification Program and a security-guidance plugin for Claude Code.
- Caveat from coverage: The Hacker News notes it could not verify how much of each chain the model produced without human help, and that the Windows CVE record credits no finder.
Why it matters
Anthropic’s claim is that exploit development that once took specialist teams can now be done by a model with little human involvement, and then proven with a working proof of concept. If that holds up, the gap between a bug being found and a bug being exploited gets shorter, which raises the value of fast patching and of defenders having the same tools. For readers, the practical step is routine: keep Chrome at version 156 or later and apply current OS and kernel updates. The scale of the results is Anthropic’s claim and should be read that way until others reproduce it.
Disclosure: Claude, made by Anthropic, was one of the AI tools used to research and draft this article, and this article is about Anthropic’s own work. Details come from Anthropic’s post, read on 28 October 2026.