Latest / Frontier models and safety
Anthropic’s unreleased model chained flaws into working exploits for Chrome, Safari, Android, Windows and Linux
See how this story connectsAnthropic’s Frontier Red Team said on 27 October 2026 that an unreleased internal research model, after initial prompting, wrote five working attack chains against widely used software. In Chrome it combined four flaws into one-click code execution outside the sandbox; Google has assigned and patched 62 CVEs from Anthropic’s reports as of Chrome 156, all rated critical or high, including 13 sandbox escapes. The model also built a Safari chain that disabled the same-origin policy, a lock-screen bypass that took photos from a stolen Pixel 9, a remote crash of Windows servers that answer HTTP/3 (CVE-2026-33096) and a zero-click root exploit in the Linux kernel’s multipath TCP stack. Anthropic says every flaw was reported to the vendor and has been fixed.
Why it matters
A single model found several separate flaws and combined them into working exploits against browsers and operating systems used by billions, all of which have now been patched.
- When
- 27 Oct 2026
- ID
WTA-N-2026-0472- Where
- United States
- Who
- Anthropic, Google, Apple, Microsoft
Summary written with AI by wheresthe.ai, from Anthropic and the reporting credited above. Checked against the source on 28 Oct 2026.
Source copy: saved on 28 Oct 2026 to check this story and not republished, because the text belongs to its publisher. Also held by the Internet Archive.
Cite this story
WTA-N-2026-0472: “Anthropic’s unreleased model chained flaws into working exploits for Chrome, Safari, Android, Windows and Linux.” wheresthe.ai, 27 Oct 2026. https://wheresthe.ai/d/us-anthropic-unreleased-model-builds-five-exploit-chains-in-browsers-and-os-2026-10/ (source: Anthropic).
Spotted an error? Email [email protected].