Anthropic has published the most detailed account yet of what its frontier models can do as offensive security researchers. In a post dated October 27, the company's Frontier Red Team describes five exploit chains that an unreleased internal research model found and assembled over recent months, aimed at some of the most widely deployed software in the world: Chrome, Safari, Android, Windows and Linux.
The Chrome case is the most striking. According to Anthropic, after an initial prompt the model found four separate bugs and chained them: a heap corruption flaw in the V8 JavaScript engine, a second bug that escaped V8's memory sandbox and defeated address randomization, a race condition in CacheStorage that leaked the browser process's memory layout, and a use-after-free in the FedCM sign-in feature that let code run outside Chrome's process sandbox. The proof of concept opened the Calculator app on a default Chrome install on macOS seconds after a page loaded. Anthropic says Google has assigned and patched 62 CVEs from this work as of Chrome 156, all rated high or critical, including 13 sandbox escapes.
In Safari, the model built a chain that never needed to run its own code. It combined a use-after-free in JavaScriptCore, a way around WebKit's Gigacage isolation and a flaw in the sandbox's IPC layer to switch off the same-origin policy, which would let a malicious page read history, cookies and data from other sites where the user is signed in. Anthropic says Apple acknowledged the report the day it arrived and has shipped a fix.
The other three cases cover different ground. On a Google Pixel 9, the model chained three flaws to pull photos and personal data from a locked phone over USB, combining source review of Android with reverse engineering of Google Play services; Google has addressed it. On Windows, binary analysis of the kernel's QUIC implementation turned up an out-of-bounds read that could crash any server answering native HTTP/3 requests, now CVE-2026-33096. On Linux, a race condition in multipath TCP gave a remote attacker a root shell without credentials; in the proof of concept, recovering a kernel address took roughly 48 minutes and getting to command execution another five, and the fix, CVE-2026-98432, has been backported to stable kernels.
Anthropic says all findings went through coordinated disclosure, which gives each vendor 90 days for a fix and then another 45 days before Anthropic goes beyond the public advisory. It does not name the model or say when, or whether, it will be released.
The company also describes its method. Many scanning agents ran in parallel with different strategies, from checking each function to hunting for breaches of an application's documented threat model, and each scanner was scored by how many new bugs it added. Every confirmed finding then went through automated variant analysis and a common verification and severity pipeline. Anthropic argues that spending more compute at test time and diversifying scanners both raise the number of bugs found, and it recommends scanning code at pull-request time, for which it has released a Claude Code security plugin.
The post amounts to a warning that exploit chaining, once the work of a few specialist teams, can now be done by a model with little human help. Anthropic points defenders to its expanded Cyber Verification Program, which gives vetted security professionals access to models such as Claude Mythos 5.1 with fewer blocking classifiers. The account comes from Anthropic alone: apart from the CVE numbers and vendor fixes it cites, the amount of human guidance involved and the model's success rate were not independently documented.