Anthropic's Frontier Red Team details five exploit chains an unreleased internal Claude model built for Chrome, Safari, Android, Windows and Linux; Chrome 156 fixes 62 CVEs
Anthropic's Frontier Red Team published a research post on Oct 27 saying it spent the past few months using an unreleased internal research model to find critical vulnerabilities in browsers and operating systems, and that after initial prompting Claude wrote five full exploit chains: one-click remote code execution with a sandbox escape in Chrome, a same-origin policy bypass in Safari, data extraction from a locked Android phone over USB, a remote denial of service against Windows HTTP/3 (QUIC), and zero-click root code execution on Linux servers with a multipath TCP listener. Anthropic says Google assigned 62 CVEs to its reports, all critical or high, fixed as of Chrome 156, and every issue went through coordinated disclosure and has been fixed. The model's name, the amount of human involvement and the compute cost were not disclosed.
Key Takeaways
- The Chrome chain links 4 bugs: V8 heap corruption, a V8 sandbox escape that defeats ASLR, a CacheStorage race condition and a FedCM use-after-free; the PoC launches Calculator within seconds of a page loading in default Chrome on macOS
- Per Anthropic, Google assigned 62 CVEs to its reports, all critical or high, including 13 sandbox escapes and 21 renderer-compromise bugs, fixed as of Chrome 156
- The Windows kernel QUIC out-of-bounds read is CVE-2026-33096, with likely several million exposed servers by Anthropic's estimate; the Linux MPTCP zero-click root bug is CVE-2026-98432, where the PoC leaks a kernel pointer in about 48 minutes and reaches root command execution about 5 minutes later
- Method: many parallel scanning agents scored by the extra vulnerabilities they add, with coverage tracking and automated variant analysis on every confirmed finding; Anthropic recommends scanning at PR time and has released a Claude Code security plugin
- The model is an unnamed internal research model; Anthropic did not publish the share of human work, failed attempts or compute cost
