Anthropic AI Model Chains Zero-Days Into Five Working Exploits

What Anthropic disclosed

Anthropic's Frontier Red Team has published research describing how an unreleased internal Claude model found vulnerabilities in Chrome, Safari, Android, Windows and Linux. The model then linked those bugs into five working proof-of-concept exploit chains.15 The research appeared on October 27, 2026. Anthropic says it reported every flaw to the affected vendor before publishing and that all of them have been patched.58 The exploits were built in a lab after a researcher prompted the model. None has been seen in a real attack.1

No single bug is the main finding. The bigger claim is that one model could find several separate flaws and combine them into a complete attack. Anthropic says that skill has until now belonged to a small number of specialist teams.1 The company's own wording is that frontier models can now find and combine multiple vulnerabilities into a working exploit, and that this is making an expert skill widely available.7

The five chains, and how serious each one is

The Chrome chain got the most detailed coverage. A malicious page corrupted memory in V8, Chrome's JavaScript engine. A second flaw escaped V8's memory sandbox and took over the renderer. A race condition in CacheStorage revealed the memory layout of the more privileged browser process. Finally, a use-after-free in FedCM, Chrome's sign-in feature, let code run outside the browser sandbox.13 In the demonstration, the Calculator app opened on a stock Mac running Chrome within seconds of the page loading, with no further clicks.17 Anthropic says Google assigned 62 CVEs to its Chrome reports and fixed them by Chrome 156. That total includes 13 sandbox escapes and 21 flaws that could compromise the renderer.4

The Safari chain never ran attacker code. It gained read and write access to browser memory and then changed a single value to switch off the same-origin policy, the rule that stops one website from reading another site's data.1 With that rule off, a hostile page could read history and cookies and send requests to sites where the user was signed in, such as email or a bank account.17 Apple fixed the main use-after-free in iOS and iPadOS 26.5.2.1 Reporting on the Safari mechanics differs slightly. One account adds a bypass of WebKit's Gigacage defense and a flaw in the sandbox's inter-process messaging that was used to read stored data from disk.3

The other three chains are narrower. The Android exploit could pull photos and other data from a locked phone, but only with physical USB access.8 The Windows chain is a denial-of-service attack: a few network packets crash a server that answers HTTP/3 requests, and repeating them keeps it down. It does not run code or steal data.18 The Linux chain is the most severe. It gives a remote attacker root on a server running a multipath TCP listener, with no login and no user action.37 Anthropic says its proof of concept needed 48 minutes to leak a kernel address and get around KASLR, then five more minutes to reach a root shell. A failed attempt does not crash the system, so an attacker can keep retrying.1 It only works with that specific network setup, so most Linux systems are not affected.8

Where the reporting diverges

Most coverage repeats Anthropic's account. The more careful outlets point out which parts can be checked independently and which cannot.

Vendor credits support part of the story. Google's release notes credit "Xinyang Ge of Anthropic, assisted by Claude" for specific Chrome fixes, though not for all 62. Apple credits Milad Nasr and Nicholas Carlini "with Claude" for the Safari fix.1 Some commentary treats those credits as outside confirmation of the whole effort.2

The CVE records are harder to match. Anthropic describes the Windows flaw as an out-of-bounds read in the kernel's QUIC handling. The public record for CVE-2026-33096 instead names HTTP.sys, credits no finder, and rates it 7.5. No public source links the two descriptions.1 Some outlets simply describe the bug as an HTTP.sys flaw.6 The Linux case has the same problem. Anthropic links its chain to CVE-2026-98432, a use-after-free rated 9.8, but the public record describes an IPv4 TCP fix, not a multipath TCP one. Only Anthropic's post connects them.19

The biggest disagreement is over autonomy. Some write-ups say the model built the chains "autonomously."25 Anthropic's own wording is more limited: "initial prompting" and "little human involvement." It does not say what a person did at each step, and it does not name the model.19 One analysis also notes that the report does not show that any publicly available Claude model can repeat these results.9

My reading is that the vendor credits make it reasonable to accept the overall capability claim. The exact share of the work done by the machine should still be treated as Anthropic's own account until outside researchers reproduce it.

Why the prompt-injection angle matters more than the bugs

The patched bugs are a past problem. A model that can chain exploits is a future one, and the main way such a model could be turned against its users is prompt injection.

Anthropic's own computer-use documentation acknowledges that Claude will sometimes follow instructions it finds in webpages or images, even when they conflict with what the user asked for. It tells developers to keep the agent away from sensitive data and actions.11 Security researchers point out that for an agent, prompt injection does not just produce wrong answers. It produces wrong actions by software that can click, type, fetch and execute.11 Anthropic's published numbers show the issue is improving but not solved. In earlier system cards, defenses raised prompt-injection safety scores to 89 percent for Claude Opus 4 and 86 percent for Sonnet 4.11

Together, those two facts point to an uncomfortable conclusion. One security vendor describes a coding agent that holds source code, API keys and an internet connection. Today, an injected instruction might steal credentials. With exploit-chaining ability built in, the same instruction could tell the agent to find a zero-day in the company's own code, write an exploit, and send it out over ordinary-looking HTTP traffic.15 Another analysis argues that a stronger model is also a more valuable target. Anyone who controls its context gets a far more powerful execution environment.16

This has already happened with real products. Researchers at Oasis Security combined an invisible prompt injection in Claude.ai URL parameters with Anthropic's own Files API to quietly pull data out of a user's conversation history. They noted that MCP servers and enterprise integrations would make the damage much larger.14 Public CVEs for Microsoft 365 Copilot and Cursor show the same pattern in other tools. In both, injected content led to information disclosure or, in Cursor's case, a rewritten configuration file that ended in remote code execution.11 Anthropic's Opus 4.7 system card also said plainly that Claude Code Security Review was "not hardened against prompt injection."18

There is also a structural problem. Language models do not reliably tell data apart from instructions. The UK's National Cyber Security Centre has warned that prompt injection may never be fully fixed, and OpenAI has reached a similar conclusion about AI browser agents.17 If that is right, a model that can chain exploits makes every remaining injection gap more dangerous.

The access question

Anthropic is presenting the work as help for defenders. It uses a coordinated disclosure policy that gives vendors 90 days to patch and another 45 days before it discusses details beyond a public advisory.1 The research model itself is being held back under the company's Responsible Scaling Policy.5 Anthropic is also pointing security teams to an expanded Cyber Verification Program, which gives vetted professionals access to Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1.1

The approach has a gap. Gating which people can use a model is not the same as controlling what a deployed agent does once it reads hostile content. One comparison of vendor safeguards notes that a separate program, which removes cyber safeguards for vetted penetration testers, does nothing about prompt-injection defense.18 Others argue that an attacker who hijacks an agent does not need to find any bug. They get whatever access the agent already has.19

An industry-wide shift

Anthropic is not working alone. OpenAI's Patch the Planet initiative uses Codex to find and confirm flaws in browsers and operating systems, and it has reported findings in Chrome, Safari, Firefox, OpenBSD and FreeBSD.4 Cybernews notes that the Anthropic disclosure came a month after OpenAI said its own unreleased cyber model had found hundreds of vulnerabilities. Experts quoted there warn that AI may surface weaknesses faster than organizations can verify and patch them.7

Some security vendors are already telling customers to assume the time between disclosure and a working exploit will shrink sharply. They recommend network-level controls and segmentation to cover the gap.2

The practical conclusion is that exploit-chaining ability will not stay in internal labs. Organizations running AI agents should treat them like privileged infrastructure. That means sandboxes, outbound traffic controls, least-privilege access and treating configuration and memory files as security-sensitive.1115 The bugs in this report are fixed. The prompt-injection weakness that could turn this kind of model against its own users is not.