Anthropic's Frontier Red Team published research on October 27 showing an unreleased internal model building multi-step exploits against Chrome, Safari, Android, Windows and Linux. Not "found a crash." Built chains that work. All of it was reported to the vendors under coordinated disclosure and patched before the write-up, which is the right way to do this.
What It Built
Five chains, all in the lab, none seen in real attacks:
- Chrome, one click. A chain through V8, the renderer, CacheStorage and FedCM that ran code outside the sandbox on macOS after a single page visit.
- Safari, one click. A data-only chain that broke the same-origin policy, enough to read history, cookies and session data. Apple has shipped the fix.
- Android, physical access. Three flaws chained to pull photos and personal data off a locked Pixel 9 over USB. Google has addressed it.
- Windows, remote DoS. A kernel QUIC out-of-bounds read that crashes remote machines, tracked as CVE-2026-33096 and fixed by Microsoft.
- Linux, zero click. A race-condition use-after-free in the multipath TCP stack that gets root over the network, tracked as CVE-2026-98432 and patched upstream.
The Chrome work alone produced 62 CVEs, all rated critical or high, including 13 sandbox escapes, fixed as of Chrome 156.
What I'd Keep in Perspective
Anthropic says each exploit started with "initial prompting" from people, and that the model then needed little human involvement. The post doesn't break down exactly what humans did at each step, and The Hacker News notes that some CVE links (the Windows and Linux ones) rest on Anthropic's own account, since the public CVE text describes the bugs a bit differently. So: impressive, verified in the sense that the vendors fixed real bugs, and still a vendor describing its own work. Both things can be true.
Credit where it's due, too. The disclosure process here (90 days for the vendor, then 45 more before talking details) is more patient than a lot of human researchers manage.
Why This Matters to Defenders
For years the comforting assumption was that finding a bug is easy and turning it into a reliable exploit chain is hard, slow and rare. That assumption bought defenders time. A patch would land, and you had weeks before a weaponized chain showed up.
If models can do the hard part, that time shrinks. We've already watched it happen this month: PHP2Shell exploit attempts within 48 hours, and attackers with AI tooling on their infrastructure rooting firewalls in under 15 minutes. Anthropic's lab work is the polished version of what the messy version in the wild is already doing.
Two things follow:
- Patch latency is now your main risk number. Not CVSS. How long between "fix available" and "fix deployed" on your browsers, kernels and edge devices.
- Exposure matters more than ever. A zero-click network root on Linux is only a disaster if the vulnerable listener is reachable by the attacker. Fewer things reachable from the internet means fewer things an exploit-writing model can point at.
What To Do
- Update browsers fast and enforce it. Chrome 156 or later, current Safari and iOS. Managed auto-update with a short deadline, not "users will get to it."
- Patch kernels on internet-facing Linux. Check your distro for CVE-2026-98432, and turn off multipath TCP where you don't use it.
- Measure time-to-patch. Track it per asset class and report it. If it's measured in months, that's the finding.
- Shrink what's reachable. Put internal apps and admin interfaces behind identity-aware access instead of open ports.
- Use the same tools on your own code. Anthropic's advice is to scan your code with AI, including at pull request time. Attackers will. You might as well find it first.
Bottom Line
The scary part isn't that an AI wrote exploits. It's that the hardest step in offense just got cheaper, and it's getting cheaper for everyone. Defenders don't win that race by being smarter about each bug. They win it by patching faster and exposing less.
Sources: Anthropic Frontier Red Team and The Hacker News