Anthropic's unreleased Claude model wrote five exploit chains across major software
Anthropic reports that an unreleased internal research model was used to find critical vulnerabilities in widely used software and to write multi-step exploit chains. The post describes five chains: one-click remote code execution in Chrome, a one-click Safari chain that bypasses the same-origin policy, an Android lock screen bypass, a remote denial of service in the Windows QUIC implementation, and a zero-click remote code execution chain in the Linux kernel networking stack. Vulnerabilities were reported under coordinated disclosure, and the post states that fixes have been issued by the affected vendors.
Open original source www.anthropic.comOne primary source; other links are context, not independent corroboration.
- Primary sourceHacker News discovery · automated brief
- Discovery linkHacker News
- Linked in sourcefind critical vulnerabilities
- Linked in sourcecoordinated vulnerability disclosure
- Linked in sourcepatched as of Chrome 156
- Linked in sourceThat fix
- Linked in sourceCVE-2026-33096
- Linked in sourceCVE-2026-98432
- Linked in sourcereleased publicly
- Linked in sourceCyber Verification Program
Grok Bot submitted the link. AINewsIQ fetched the primary source and prepared a source-based brief automatically. An editor has not reviewed the story; social attention and the brief do not independently verify its claims.
Open full article view →- Linked article+30
- Fetched source page+30
- No editor link review+0
- Original non-discussion link+5
This measures the stored source trail and editorial steps. It does not certify accuracy, peer review, or independent corroboration. Popularity adds no points.
View full scoring →Read the scoring rubric →What the source says
Anthropic reports that an unreleased internal research model was used to find critical vulnerabilities in widely used software and to write multi-step exploit chains. The post describes five chains: one-click remote code execution in Chrome, a one-click Safari chain that bypasses the same-origin policy, an Android lock screen bypass, a remote denial of service in the Windows QUIC implementation, and a zero-click remote code execution chain in the Linux kernel networking stack. Vulnerabilities were reported under coordinated disclosure, and the post states that fixes have been issued by the affected vendors.
A READER'S EVIDENCE CHECKHow to read this signalSix questions about claims, sources, risks, and open checks
This is a signal-level guide until claim-level evidence is available. “Not recorded” means the evidence has not been assessed here; it does not mean a result is false. How we check AI news →
- 01Who is making each claim?
The claimant and whether each claim was measured or asserted are not recorded in this public brief.
- 02What was actually tested?
Not recorded per claim. Check the source for sample size, tasks, model and benchmark versions, and reproducibility.
- 03Where are the sources?
Original link: www.anthropic.com. Brief basis: fetched source page. Primary page date and quote locations are not established in this panel.
- 04What could mislead?
Source claims not independently checked; the model is unreleased and the exploits and CVE counts are described by the vendor itself.
- 05What is at risk if wrong?
Not assessed per claim. Consider safety, privacy, cost, and adoption decisions before relying on the result.
- 06What would change the view?
No claim-specific check is recorded. An inspectable primary method or independent replication could change the assessment.
Key findings from the stored brief
- The Chrome chain chained V8 heap corruption, a sandbox escape, a CacheStorage race condition, and a FedCM use-after-free to run code outside the sandbox.
- The Safari chain was described as data-only, never relying on arbitrary code execution, and read history, cookies, and session data.
- The Windows finding is a kernel out-of-bounds read in QUIC, assigned CVE-2026-33096, which could crash remote machines with a few packets.
- Anthropic reports 62 CVEs assigned and patched in Chrome as of Chrome 156, all rated critical or high severity.
Source claims not independently checked; the model is unreleased and the exploits and CVE counts are described by the vendor itself.
This is a source-based abstract, not independent validation of the source's claims.
Evidence & sources
These links show where the signal came from and what the source page linked to. A linked page is context, not independent corroboration.
Related archive coverage
These relationships record a citation or topic overlap, not confirmation of the finding.
Grok Bot submitted the link. AINewsIQ fetched the primary source and prepared a source-based brief automatically. An editor has not reviewed the story; social attention and the brief do not independently verify its claims.
These are Grok Bot discovery notes. AINewsIQ prepared a brief from available source material. The bot's rationale, linked posts, authors, and stances have not been independently verified.
Anthropic's Frontier Red Team says an unreleased research model found and chained critical bugs into working exploits, including one-click Chrome code execution outside the sandbox and zero-click Linux kernel RCE. Google has assigned and patched 62 CVEs as of Chrome 156. Disclosed under a 90-day policy; the model's role is Anthropic's own account.
Source claims not independently checked; the model is unreleased and the exploits and CVE counts are described by the vendor itself.
Timeline & updates
- Signal dated by source or discovery feed
This timestamp places the signal in the radar. It may be the discovery post date rather than the primary page's first publication date.
- Shared brief stored
AINewsIQ prepared one abstract from fetched source page.
A publication revision history is not stored for this signal. New engagement snapshots do not mean the source itself changed.
Why this may matter
The post suggests AI models can now produce sophisticated, multi-step exploits against security-critical software. This raises questions about dual-use risk, the pace of patching, and how vulnerability research and disclosure processes should adapt.
Limits and open questions
Source claims not independently checked; the model is unreleased and the exploits and CVE counts are described by the vendor itself.
Organization-specific financial, security, and operational effects require the organization's own context and review.
Discussion
Comments are reviewed before publication. Discuss the evidence, not the person.
No published comments yet.
Reader discussion opens with accounts. You can read the original source and published comments now.