On 27 October Anthropic's Frontier Red Team published an account of 5 exploit chains written by an unreleased internal model, against Chrome, Safari, Android, Windows and Linux. Each flaw went to the vendor under a disclosure policy giving 90 days to patch and a further 45 before details beyond the public advisory are discussed.

Read it the way we read any vendor research: it is a company's account of its own product, the model is unreleased so nobody outside can reproduce any of it, and no third party has verified the chains. What is checkable are the CVE numbers and the patches, and those are real.

Chrome, four bugs deep

The proof of concept launches the Calculator app from a stock, default-configuration Chrome on macOS within seconds of a page loading, with no further interaction from the person who opened the page.

Getting there took 4 separate discoveries chained in order: heap corruption in V8, a second flaw to escape V8's memory sandbox and defeat ASLR with a return-oriented programming chain, a race condition in CacheStorage to read memory outside the renderer sandbox, and a use-after-free in FedCM, Chrome's federated sign-in feature.

The number attached to the Chrome work is the one worth repeating, because it is far larger than the chain itself. 62 CVEs assigned and patched as of Chrome 156, every one of them rated critical or high, and among them 13 sandbox escapes and 21 flaws that could have been used to compromise the renderer.

The Safari chain never executes code

The Safari result is the more interesting one technically. The chain lets any website's JavaScript bypass the same-origin policy, the 1 rule that keeps one site's code out of another site's data, which means reading history, cookies and authenticated sessions, and sending authenticated requests to other domains and reading the replies. Signed into your email in another tab, and the page you just opened can read it.

It does that without arbitrary code execution anywhere. The write-up calls it a data-only attack: full read and write access to the browser process's memory, used to change exactly 3 things, a security flag, an object size and a URL. The sentence that ought to outlive the post is about the ingredients, several of which "are not vulnerabilities on their own but intended behaviors that become exploitable when combined".

Apple acknowledged the report the same day it was submitted, and the fix has shipped.

Windows and Linux

The Windows finding is an out-of-bounds read in the kernel's QUIC implementation, reachable remotely by anything answering HTTP/3 with the native stack. A few packets crash and restart the machine, and repeating that is an indefinite outage. Anthropic estimates several million such servers are listening on the internet. Microsoft assigned CVE-2026-33096 and fixed it.

How it was found matters as much as what it is. The model was handed the Windows executable and asked to reverse-engineer it with Ghidra, write a fully annotated C program reproducing the relevant behaviour, compare that program against the binary for correctness, and then study its own reproduction for flaws.

The Linux chain is the one that should keep people up. A race-condition use-after-free in the kernel's networking stack lets a remote attacker with no credentials and no user interaction run commands as root against a server with a multipath TCP listener. Stage one defeats KASLR by making the kernel over-read and leak a pointer. Stage two overwrites a callback pointer and ends in a shell command. In their proof of concept it takes 48 minutes to leak the pointer and another 5 to reach command execution, and a lost race only fails the handshake rather than crashing the box, so it can be retried forever. CVE-2026-98432, patched upstream and backported to the maintained stable branches.

The Android one is the one you can picture

A stolen, locked phone. The work combined source analysis of Android's open parts, reverse engineering of Google Play services binaries, and live testing on a physical Pixel 9, then chained 3 findings into an exploit that pulls photos and personal data off the device without unlocking it.

Four protections were bypassed in turn: a locked phone's refusal to move data over USB, the transfer protocol's rejection of unauthorised peers, the six-digit code the user is supposed to confirm, and a hardcoded check that is meant to stop file contents crossing USB, which a fallback path did not honour. Google has addressed it.

Hold this next to the rest of the week

Two attacker-side AI stories ran this week. Trend Micro's three cases in Japan, where the way in was default credentials and exposed admin pages. And the operation that rooted 25 firewalls, where the researchers wrote plainly that they had no direct evidence AI wrote the exploit.

Against that, 62 patched Chrome CVEs from a defender-side programme. The largest pile of AI-found vulnerabilities published this month is on the defending side, and it arrived with fixes already shipped. That is the useful comparison, and it holds only as long as the asymmetry does.

What to do

  • Chrome 156 or later. The 62 fixes are in it, and that is the single highest-value update on this list.
  • Safari and the operating system updates that carry WebKit. The fix is out.
  • Windows: the April 2026 update that carries CVE-2026-33096, if any server you run answers HTTP/3 on the native stack.
  • Linux: a kernel from your distribution's stable series, since CVE-2026-98432 was backported. If you expose multipath TCP, treat it as urgent.
  • Android: current Play services and system updates, and remember the chain needed physical possession.

What is not established

  • Whether any of it reproduces. The model is unreleased, so nobody outside the company can run the same work.
  • Whether the chains are as described. No third party has verified them, and the account is the vendor's own.
  • How much human prompting each chain took. The post says "after initial prompting" and does not quantify it.
  • What the Android flaws are. Google has fixed them and no public record was found by the outlets that looked.
  • What the same capability looks like in other hands. The post also describes a programme that gives vetted security professionals access to capable models with reduced blocking classifiers, which is the dual-use question stated out loud rather than answered.