Anthropic’s unreleased model chains five working exploits across Chrome, Safari, Android, Windows and Linux

October 27, 2026. Anthropic publishes “Discovering and exploiting vulnerabilities in critical, real-world software with Claude,” a research post detailing five working exploit chains built by an unreleased internal research model. The targets: Chrome, Safari, Android, Windows, and the Linux kernel. October 28, 2026. The result ripples through the security press. The point that matters: what was once the domain of a handful of elite teams — finding multiple flaws and chaining them into a runnable exploit — is now a model capability, demonstrated by proofs of concept anyone can re-run.

Five chains, five defensive stacks undone

Anthropic’s demonstration earns its weight through diversity. Each chain had to cross a different defensive stack, and the model defeated all of them after an initial prompt, “with little to no user interaction.”

Chrome — one-click remote code execution. The model found a flaw in V8, Chrome’s JavaScript engine, that let a malicious page corrupt the heap; a second to escape V8’s memory sandbox and defeat ASLR through a ROP chain; a race condition in CacheStorage to read memory outside the sandbox and learn the privileged browser process layout; and finally a use-after-free in FedCM to run arbitrary code outside the sandbox. Google assigned 62 CVEs, all patched in Chrome 156, including 13 sandbox escapes.

Safari — same-origin policy bypass. The model built a “data-only” attack that never relies on code execution: a use-after-free in JavaScriptCore, an arbitrary read/write primitive outside the Gigacage, a flaw in the sandbox’s IPC to read history, cookies, and sessions from disk, then the disabling of the SOP flag. Apple acknowledged the report the same day and shipped a fix.

Android — lock screen bypass. On a physical Pixel 9, the model combined source-code analysis, reverse engineering of Google Play services binaries, and live testing to extract photos and personal data from a stolen phone without unlocking it.

Windows — remote denial of service. The model identified, through binary analysis (with Ghidra), an out-of-bounds read in the kernel’s QUIC implementation: a few packets sent to an HTTP/3 server crash and restart the machine. The flaw, fixed by Microsoft, is CVE-2026-33096; Anthropic estimates “several million” servers were listening.

Linux — zero-click remote code execution. The model turned a race-condition UAF in the kernel’s MPTCP networking stack into running commands as root with no credentials or interaction. The proof of concept takes 48 minutes to leak a kernel pointer (defeat KASLR) and another five minutes to reach a shell. The flaw, patched upstream and backported, is CVE-2026-98432.

What is true, and what is not

This result must be read with rigor. These exploits were produced in the lab, after an operator prompted the model; Anthropic notes none were seen in a real attack. This is not an offensive campaign — it is a capability signal.

The nuance does not shrink the impact. The post demonstrates that a frontier model can, with little human involvement, cover the whole cycle: finding the vulnerability, building the chain, and proving it with a runnable exploit. Historically, that work required specialist teams, months of effort, and rare skills. The demonstration collapses the marginal cost to that of a well-worded query.

Anthropic owns this reading. The authors — Nicholas Carlini, David Dworken, and five colleagues — write plainly that “frontier models have the ability to discover and combine multiple vulnerabilities into a working exploit,” a skill “historically the domain of few specialist teams.”

From artisanal exploits to exploits on demand

This result sits on a long arc. Fuzzing — popularized by AFL — found crashes, rarely full chains. DARPA’s Cyber Grand Challenge in 2016 demonstrated automated exploit generation and patching, but in a sandbox against simplified targets. Eight years later, Anthropic’s demonstration targets real, deployed products with production defenses — and produces runnable exploits anyone can verify.

The phrase “with little or no user interaction” is the tipping point. It means the human bottleneck — the expert who reads the code, understands the flaw, designs the primitive, assembles the chain — disappears. The marginal cost of discovery and exploitation collapses toward that of a well-worded query, which changes the nature of the vulnerability race.

Disclosure is transformed too. Anthropic applies a 90-day patch window, then a further 45 days before discussing details beyond public advisories — a norm inherited from Google’s Project Zero. But when the discoverer is a model capable of producing dozens of flaws per session, the volume and pace of that disclosure become a problem in their own right: vendors will have to absorb a stream of reports their security teams were never sized to handle.

The balancing nuance, finally: these chains were produced on request, in a lab, with a human operator. Autonomy — a model that finds and exploits without being prompted — remains an open question, and Anthropic reports no real-world attacker use. The signal is a demonstrated capability, not yet an observed campaign.

Two methodological lessons

The post contains two operational lessons that go well beyond Anthropic.

Test-time compute scaling and scanner diversity raise the discovery rate. The team built a platform that runs many scanning agents in parallel, measures each by the number of new vulnerabilities it contributes, and adjusts coverage dynamically. Strategies range from raw coverage (“is there a flaw in this function?”) to threat-model analysis (“what bypasses the documented threat model?”), with automated variant analysis on every confirmed finding.

Fixing the existing backlog solves only half the problem. The other half is cutting the rate at which flaws enter the code — which means scanning at pull-request time. Anthropic has released a Claude Code “security guidance” plugin that bakes this check into the development cycle.

What this changes for defenders

The practical conclusion is not “panic,” but “arm yourself with the same models before the attackers do.” Anthropic expanded its Cyber Verification Program, which gives its most capable models (Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1) to qualified security professionals, with reduced blocking classifiers.

The real dial is no longer “who can find flaws,” but “who finds and fixes first.” When discovery becomes cheap, the window between discovery and patch becomes the battlefield — and the defense that wins is the one that scans its own code before someone else does.

Anthropic also follows coordinated disclosure: 90 days to patch, then a further 45 days before discussing details beyond public advisories. The flaws in this demonstration are therefore already fixed — the residual risk sits with whoever has not applied the updates.

Verdict

If you build or run exposed software, the signal is clear: fold model-assisted scanning into your pipeline, ideally at pull-request time. The cost is low next to the risk, and it is Anthropic’s own recommendation. If you are a security professional, apply for the Cyber Verification Program: the same models that built these chains are being handed to defenders, and that is where the balance of power re-tilts. If you read this as a plain operator, the lesson is more mundane: apply the Chrome 156, Windows, and Linux kernel patches without delay, because the demonstration proves working exploits already exist somewhere — even if, for now, they have not left the lab.

References

• Anthropic — Discovering and exploiting vulnerabilities in critical, real-world software with Claude (October 27, 2026)
• The Hacker News — Anthropic’s Unreleased AI Model Chains Flaws Into Working Exploits (October 28, 2026)
• NVD — CVE-2026-33096 (Windows QUIC)
• Tenable — CVE-2026-98432 (Linux MPTCP)
• Anthropic — Cyber Verification Program