Anthropic’s Frontier Red Team said in a research post published Tuesday that an unreleased, internal research model found critical vulnerabilities in widely used browsers and operating systems, and that the team used it to build five working exploit chains. Anthropic said the chains led to remote code execution or other critical impact with little to no user interaction, and that it reported every vulnerability to the affected vendor under coordinated disclosure, which gives developers 90 days to patch and 45 more before it discusses details beyond a public advisory.
In Chrome, Anthropic said, a one-click chain ran code outside the browser sandbox; the proof of concept launched the Calculator app from stock Chrome on macOS within seconds of a page loading. Anthropic said 62 CVEs reported to Google have been patched as of Chrome 156, all rated critical or high, including 13 sandbox escapes. In Safari, it said, a chain let any website bypass the same-origin policy and read history, cookies and signed-in sessions, and Apple has shipped a fix. On Android, it said, an exploit extracted photos and other data from a locked, stolen phone over USB, and Google has addressed the issue; The Hacker News said it found no public record of that fix. On Windows, Anthropic said an exploit could remotely crash machines answering HTTP/3 requests, which Microsoft fixed as CVE-2026-33096. On Linux, it said, a remote attacker could run commands as root on servers with a multipath TCP listener, with no credentials; in Anthropic’s proof of concept it took 48 minutes to leak a kernel pointer and five more to reach a shell, and the bug, CVE-2026-98432, is patched upstream.
The post does not name the model beyond calling it unreleased and internal, although it attributes the work to “Claude.” It does not report how many attempts or runs the chains took, or break down what people did at each step; Anthropic says each chain began with “initial prompting” and that models can now do this “with little human involvement.” The Hacker News noted that the capability claim rests on Anthropic’s own account and reported that the exploits were built in the lab, not seen in any real attack.
The Hacker News said Google’s Chrome release notes credit “Xinyang Ge of Anthropic, assisted by Claude” for specific fixes, though not all 62, and that Apple credits “Milad Nasr and Nicholas Carlini with Claude, Anthropic” in iOS and iPadOS 26.5.2. It added that the public record for the Windows CVE names HTTP.sys and credits no finder, and that the Linux CVE record describes an IPv4 TCP fix rather than multipath TCP, so those links rest on Anthropic’s post.
AI Tech Daily previously covered Anthropic’s Cyber Verification Program expansion, and the UK AISI cyber test results for Claude Mythos 5.