Anthropic's Five Claude Exploit Chains: What the Frontier Red Team Post Claims, and What It Leaves Out

On October 27, Anthropic's Frontier Red Team published a post saying an unreleased, internal research model found critical vulnerabilities in widely used software over the past few months, and that it chained them into working exploits. The post describes five attack chains across Chrome, Safari, Android, Windows and the Linux kernel. Its advice to defenders is short: scan your own code, and do it at pull request time.

This is Anthropic describing its own model and its own results. I read the post in full and I have not verified any claim in it. I did not read the vendor advisories, CVE records or the Claude Code plugin the post mentions. Below, "the post says" means exactly that.

What the post claims

The post says Claude wrote each exploit "after initial prompting", and that the chains lead to remote code execution and other critical impacts "with little to no user interaction". It lists five:

1. Chrome, one-click remote code execution. A chain through V8 (a heap corruption bug, then a second bug to escape the V8 memory sandbox and defeat ASLR), a race condition in CacheStorage to learn the privileged process layout, and a use-after-free in FedCM to run code outside the sandbox. The proof of concept launches Calculator on macOS within seconds of the page loading. The post says Google has assigned 62 CVEs, patched as of Chrome 156, all rated critical or high, including 13 sandbox escapes and 21 that could compromise the renderer.

2. Safari, one-click same-origin policy bypass. A use-after-free in JavaScriptCore, a way around WebKit's Gigacage, a sandbox IPC flaw to read history, cookies and session databases, and then a data-only step that disables the same-origin policy. The post says Apple acknowledged the report the same day and a fix is available.

3. Android lock screen bypass. Chaining three of several found vulnerabilities, tested on a physical Pixel 9, to extract photos and personal information from a stolen locked phone. The post says Google has addressed the issue.

4. Windows remote denial of service. An out-of-bounds read in the kernel's QUIC implementation, reachable over HTTP/3, assigned CVE-2026-33096, which the post says Microsoft resolved. The post estimates "likely several million" servers listen for such requests. That estimate is Anthropic's, and the post does not show how it was reached.

5. Linux, zero-click remote code execution. A race-induced use-after-free in the networking stack, reachable on servers with a multipath TCP listener. The post says the proof of concept takes 48 minutes to leak a kernel pointer and another five minutes to reach command execution as root. It gives CVE-2026-98432 and says the fix was patched upstream and backported to all maintained stable kernel branches.

The post adds that its work on open source continued: privilege escalation bugs on OpenBSD, FreeBSD and Linux, sandbox escapes in popular sandboxing infrastructure, and "numerous" web application vulnerabilities. It gives no counts for those.

The disclosure terms

Per the post, each vulnerability was reported to the affected vendor under coordinated disclosure: 90 days to patch, and a further 45 days before Anthropic discusses details beyond a public advisory. That matches a common industry pattern. It also means the post is deliberately light on technical detail for anything still inside that window.

How the model was used

Two details from the post matter for anyone building agents.

For the Windows bug, the post says Anthropic gave the model the executable and asked it to reverse-engineer the software with existing tools (it names Ghidra), write an annotated C program reproducing the relevant behavior, compare that program with the binary, and then study the code for vulnerabilities. A request for higher-risk issues surfaced the QUIC bug.

For scale, the post says it built a platform that runs many scanning agents in parallel and measures each scanner by how many additional vulnerabilities it adds to the mix. Strategies range from pure coverage ("is there a vulnerability in this function?") to goal-based and threat-model-based scanners. Claude also ran variant analysis on each confirmed finding, and every finding goes through a standardized verification and risk rating pipeline. The post's stated lesson: test-time compute scaling and scanner diversity "substantially increase" how many vulnerabilities you find.

What the post tells defenders

• Scan your own code. The post says this is "more important than ever".
• Fix the backlog, but also cut the rate at which new bugs enter. Anthropic recommends scanning at pull request time, and says it built security guidance into its development process through a Claude Code plugin that it released publicly.
• Anthropic recently released an expanded Cyber Verification Program for qualifying security professionals. The post says it includes access to Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1 and other new models, with reduced blocking classifiers.

What the post does not tell you

These are gaps in what I read, not criticisms of the research.

• The model. It is "unreleased" and "internal". The post does not name it, so you cannot test the claims with a public model.
• The denominator. The post shows five chains. It does not say how many scans, hours, dollars of compute or human steps went into them, or how many attempts failed. "After initial prompting" does not describe how much human guidance followed.
• False positives. The post says findings pass through verification, but it gives no false positive rate.
• Independent confirmation. The vendor outcomes (CVE counts, patches) are reported by Anthropic. I did not check them against the vendors' own advisories.
• Cost. There is no price for the approach, which matters if you are deciding whether to run something similar.

What I would check

These are my untested suggestions, not results.

1. Your PR pipeline. Find out whether any security scan runs on pull requests today, and which classes of bug it can see.

2. Backlog and rate. Count open security findings and new findings per month. The post's framing makes both numbers worth knowing.

3. Patch speed for browsers and kernels. If you run Chrome, Safari-based tools, Android devices or Linux servers, check how fast updates reach them. The post says fixes exist for the cases it names.

4. Multipath TCP and HTTP/3 exposure. If you run servers that listen for either, check your vendor's advisory for the CVEs the post names.

5. The plugin. If you use Claude Code, read the security plugin's source and permissions before you install it, like any plugin.

6. Program eligibility. If you do security work, read the Cyber Verification Program terms before you assume you qualify.

What I would not conclude

• That these results generalize to your code. The targets are some of the most scrutinized software in the world, and the post itself calls them a "bellwether".
• That attackers have the same capability. The post describes Anthropic's own unreleased model.
• That every named issue is fixed everywhere. The post gives patch status per vendor, and your own versions still matter.
• That the numbers are verified. I read one source and it is the vendor.

Frequently asked questions

What did Anthropic announce?

A post by its Frontier Red Team describing five exploit chains that an unreleased internal Claude model wrote, in Chrome, Safari, Android, Windows and Linux.

Is the model available?

The post says it is an unreleased internal research model. It separately lists models in the Cyber Verification Program: Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1.

Were the bugs fixed?

The post says Chrome CVEs were patched as of Chrome 156, Apple's fix is available, Google addressed the Android issue, Microsoft resolved CVE-2026-33096, and the Linux bug CVE-2026-98432 was patched upstream and backported. I did not verify these.

What is the disclosure policy?

Vendors get 90 days to patch, plus 45 days before Anthropic discusses details beyond a public advisory.

What does Anthropic tell defenders to do?

Scan their own code, preferably at pull request time, and fix the existing backlog while lowering the rate of new bugs. It points to a Claude Code plugin it released publicly.

How much did this cost?

The post does not say.

Can I reproduce this?

Not from the post alone. It does not name the model or publish the exploits, and it limits detail under coordinated disclosure.

Sources

All pages read on October 28, 2026.

• Discovering and exploiting vulnerabilities in critical, real-world software with Claude (Anthropic, Frontier Red Team, October 27, 2026): the five chains, disclosure terms, scanning platform, defender advice.

Not read: vendor advisories and CVE records, the Claude Code security plugin, the Cyber Verification Program terms, and any independent analysis.