# Anthropic Says an Unreleased Model Built Five Working Exploit Chains, and Google Has Patched 62 Chrome Flaws From the Work

Times of AI Desk · 2026-11-01 · Security

[https://timesof.ai/2026/11/anthropic-unreleased-model-five-exploit-chains-62-chrome-cves](https://timesof.ai/2026/11/anthropic-unreleased-model-five-exploit-chains-62-chrome-cves)

> Anthropic's Frontier Red Team says an unreleased internal research model, after initial prompting, wrote five attack chains against Chrome, Safari, Android, Windows and Linux, including zero-click root on Linux servers running multipath TCP. Anthropic says 62 Chrome CVEs were assigned and patched as of Chrome 156. The vendors have shipped fixes; how much of each chain was human work is not broken down.

The claim that matters in Anthropic's latest security post is not any single bug but the chaining: finding several flaws and combining them into one working attack, a skill Anthropic says "historically" belonged to a few specialist teams. Its Frontier Red Team says an unreleased internal research model did that five times against some of the most heavily defended software in use, and the vendors have now patched what it found. What the post does not say is how much a human steered each chain.

## What happened

In a post dated October 27, Anthropic said it had used "an unreleased, internal research model" over the past few months and shared details of five attack chains that "led to remote code execution and other critical impacts with little to no user interaction." Each chain was written "after initial prompting," the post says. The model is not named.

The five chains, as Anthropic describes them, are:

- **Chrome:** one-click code execution as the user, outside the browser's sandbox, built from four bugs. Anthropic says **62 CVEs** have been assigned and patched as of **Chrome 156**, all rated critical or high, including 13 sandbox escapes.
- **Safari:** a one-click chain that let a website bypass the same-origin policy and read other sites' data without running its own code. Anthropic says Apple has shipped a fix.
- **Android:** extracting photos and other data from a locked phone over USB, tested on a Google Pixel 9. Anthropic says Google has addressed it.
- **Windows:** a remote crash of machines answering HTTP/3 requests with the native Windows implementation, fixed by Microsoft as CVE-2026-33096.
- **Linux:** zero-click root on servers with a multipath TCP listener, CVE-2026-98432, which Anthropic says was patched upstream and backported to maintained stable kernels. Its proof of concept needed 48 minutes to leak a kernel pointer and five more minutes to run a command.

Anthropic says it reported each flaw under a coordinated disclosure policy that gives vendors 90 days to patch plus 45 days before it discusses further detail. Its advice to defenders is to scan their own code, and it pointed to its expanded [Cyber Verification Program](https://timesof.ai/2026/10/anthropic-cyber-verification-program-three-tiers), which offers Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1 with reduced blocking to qualifying security professionals. The same team earlier described [a test of AI self-replication on IoT devices](https://timesof.ai/2026/10/anthropic-frontier-red-team-self-replicating-ai-iot-devices).

## What the outside checks add

The Hacker News, which reported the post on October 28, says the exploits were built in the lab and were not seen in any real attack. It notes that the public CVE record for CVE-2026-33096 names the Windows HTTP.sys component and does not credit a finder, and that the CVE-2026-98432 record describes the fix in different terms from Anthropic's post, which alone ties it to multipath TCP. Google's Chrome release notes credit "Xinyang Ge of Anthropic, assisted by Claude" for specific fixes, though not for all 62, and Apple credits Anthropic researchers "with Claude" for the Safari fix, the outlet reported.

CSO Online reported on October 30 that the Linux flaw was rated 9.8 and fixed in eight stable branches going back to 4.4, but that Ubuntu and Red Hat Enterprise Linux had not shipped patched kernels as of that date. Multipath TCP is opt-in, it noted.

## Limits

- The capability claim is Anthropic's own. Neither the post nor the coverage we read says how much human help each chain needed beyond "initial prompting."
- The model is unreleased and unnamed, so no outside group can test it.
- The public CVE records for the Windows and Linux bugs do not use Anthropic's descriptions, as The Hacker News noted; we did not check vendor advisories ourselves.
- Patch status on Linux distributions is as CSO Online reported on October 30 and may have changed since.

## Sources

- [Anthropic: Discovering and exploiting vulnerabilities in critical, real-world software with Claude (October 27, 2026)](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude)
- [The Hacker News: Anthropic's unreleased AI model chains flaws into working exploits (October 28, 2026)](https://thehackernews.com/2026/10/anthropics-unreleased-ai-model-chains.html)
- [CSO Online: Anthropic AI model finds Linux kernel bug that leads to remote root access (October 30, 2026)](https://www.csoonline.com/article/4242724/anthropic-ai-model-finds-linux-kernel-bug-that-leads-to-remote-root-access.html)