2026-10-27 · 2026-Q4
Anthropic: An Unreleased Internal Model Built Working Exploit Chains for Chrome, Safari, Android, Windows, and Linux
Outside the model: AI capability Agent tooling was not the attack surface, so no layer applies.
- Fixable:
- Yes, vendor patch
- Vendor response:
- Patched
- In the wild:
- No
Target
Chrome on macOS, Safari, Google Pixel 9 (Android), the Windows kernel QUIC stack, and Linux kernel multipath TCP
Impact
Anthropic's Frontier Red Team reported that an unreleased internal research model, after initial human prompting, found the flaws and built five chains. Chrome: one-click code execution outside the sandbox, chaining a V8 heap corruption, a V8 sandbox escape, a CacheStorage race, and a FedCM use-after-free. Google assigned 62 CVEs from the work, all critical or high, including 13 sandbox escapes, fixed in Chrome 156. Safari: a one-click data-only chain that disables the same-origin policy so any site can read other signed-in sites' data. Android: photos copied from a locked Pixel 9 over USB. Windows: a remote crash of machines serving HTTP/3 (CVE-2026-33096). Linux: zero-click root over the network through a multipath TCP use-after-free (CVE-2026-98432), with about 48 minutes to leak a kernel pointer and about five more to reach a root shell. All were disclosed to vendors first and are reported patched. The Hacker News could not match some of the linked CVE records to Anthropic's descriptions
Root Cause
Frontier models can now find memory-safety bugs in hardened codebases and chain them into working exploits with little human involvement, compressing the time between discovery and weaponization