Anthropic's Frontier Red Team published a report on October 27 saying that an unreleased internal Claude research model found vulnerabilities in Chrome, Safari, Android, Windows and Linux, and chained them into five working exploit chains. All of the flaws were reported to vendors under coordinated disclosure, and all had been fixed by the time the report was published.
According to the report, in each case the researchers supplied only an initial prompt, and the model did most of the work of locating the bugs and writing the exploit code. The report does not say what the model is called or whether it will be released.
What each of the five chains targets
Chrome (macOS, remote execution with one click): The model first found a heap corruption bug in the V8 engine, then broke out of the V8 memory sandbox and bypassed address randomization. It next used a race condition in CacheStorage to read browser-process memory, and finally used a use-after-free in FedCM to execute code outside the sandbox. On a default macOS install, the calculator popped up a few seconds after the page loaded.
Safari (one click): The chain starts from a use-after-free in JavaScriptCore and bypasses Gigacage isolation. It then abuses an inter-process communication flaw in the WebContent sandbox to read browsing history, cookies and session databases, and to switch off the same-origin policy. The chain needs no arbitrary code execution; by reading data alone, it can pull the contents of logged-in email or banking pages on other sites. Apple confirmed and fixed the issue the same day.
Android (lock-screen bypass): Combining source-code analysis, reverse engineering of Google Play services and testing on a physical Pixel 9, the model got past the USB restriction, the device-to-device transfer authorization, the six-digit pairing verification and the file-content restriction in turn, extracting personal data such as photos from a locked phone. Google says it has dealt with the issue.
Windows (remote denial of service): The QUIC implementation in the Windows kernel has an out-of-bounds read. A few packets sent remotely can crash and reboot a machine, and repeated sending can keep a service down. The report estimates that millions of servers on the internet are affected. The issue is tracked as CVE-2026-33096, and Microsoft has fixed it.
Linux (zero-click remote execution): The bug sits in the Multipath TCP listener and is a use-after-free caused by a race condition. An attacker needs no credentials: after remotely bypassing kernel address randomization, they hijack control flow and run commands as root. In the proof of concept, leaking a kernel pointer took about 48 minutes, and command execution followed in roughly 5 more. The patch has landed upstream and been backported to every maintained stable kernel branch.
62 CVEs for Chrome alone
Chrome is where the report's numbers are largest. The bugs Anthropic reported to Google were assigned 62 CVEs, all rated high or critical; 13 of them are sandbox escapes and 21 can be used to take control of the renderer process. All were fixed in Chrome 156. The report also mentions local privilege-escalation bugs found in OpenBSD and FreeBSD, plus several sandbox escapes and web-application vulnerabilities, without going through them one by one.
"Frontier models have the ability to discover and combine multiple vulnerabilities into a working exploit."
The report gives no total elapsed time or compute cost; only the Linux chain comes with concrete timings.
How it compares with earlier red-team results
Set next to a public case from earlier this year, the difference is how much humans had to step in. Outside researchers previously used Claude Opus to build an attack chain against an older Chromium; the public record shows about a week of work, around 20 hours of hands-on expert guidance and thousands of requests. This report stresses that the model took over after the initial prompt, and that the targets were the latest browsers and kernels of the time rather than test environments with protections turned off.
The same week, Google released Gemini 4 Carbon, which also leads with benchmark scores for finding vulnerabilities, verifying them and writing patches, and is initially open only to network defenders. Anthropic likewise has not released this research model, while publicly available models such as Mythos 5.1 are offered to vetted security practitioners through a cybersecurity verification program.
Advice for defenders
The report's recommendations lean practical: spending more test-time compute and using a variety of scanners in large-scale scans noticeably raises the number of vulnerabilities found. Beyond clearing the existing backlog, teams should also scan at the pull-request stage to keep new bugs out of the codebase. Anthropic has published a Claude Code plugin for this purpose.
"Our advice to defenders remains the same: scanning your own code is more important than ever."
On disclosure, vendors get a 90-day window to fix, followed by another 45 days before technical details beyond the advisory are discussed. Under that process, the report covers only what has already been fixed; Anthropic has not disclosed the total number of vulnerabilities the model found that remain unpatched.
Sources: Anthropic Frontier Red Team research report, ITHome, CocoLoop; we checked the five affected systems, the number and classification of Chrome CVEs, and the Linux proof-of-concept timings.