Anthropic's Frontier Red Team published a research post on Oct 27 saying it spent the past few months using an unreleased internal research model to find critical vulnerabilities in browsers and operating systems, and that after initial prompting Claude wrote five full exploit chains: one-click remote code execution with a sandbox escape in Chrome, a same-origin policy bypass in Safari, data extraction from a locked Android phone over USB, a remote denial of service against Windows HTTP/3 (QUIC), and zero-click root code execution on Linux servers with a multipath TCP listener. Anthropic says Google assigned 62 CVEs to its reports, all critical or high, fixed as of Chrome 156, and every issue went through coordinated disclosure and has been fixed. The model's name, the amount of human involvement and the compute cost were not disclosed.
Key Takeaways
- ✓The Chrome chain links 4 bugs: V8 heap corruption, a V8 sandbox escape that defeats ASLR, a CacheStorage race condition and a FedCM use-after-free; the PoC launches Calculator within seconds of a page loading in default Chrome on macOS
- ✓Per Anthropic, Google assigned 62 CVEs to its reports, all critical or high, including 13 sandbox escapes and 21 renderer-compromise bugs, fixed as of Chrome 156
- ✓The Windows kernel QUIC out-of-bounds read is CVE-2026-33096, with likely several million exposed servers by Anthropic's estimate; the Linux MPTCP zero-click root bug is CVE-2026-98432, where the PoC leaks a kernel pointer in about 48 minutes and reaches root command execution about 5 minutes later
- ✓Method: many parallel scanning agents scored by the extra vulnerabilities they add, with coverage tracking and automated variant analysis on every confirmed finding; Anthropic recommends scanning at PR time and has released a Claude Code security plugin
- ✓The model is an unnamed internal research model; Anthropic did not publish the share of human work, failed attempts or compute cost
Key Decision Metrics at a Glance
Heavy Claude Code use: compare subscription limits and API bills
Compare 40 dev plans & simulate token costs vs $20/mo subscriptions
Project Links & Resources
Direct AccessIn-Depth Technical Analysis
Background and the problem
Chaining several separate bugs into one working exploit has mostly been the work of a few elite security teams, especially against heavily sandboxed targets like Chrome and Safari. The Frontier Red Team's Oct 27 post argues frontier models can now do this with little human involvement and hand over PoCs anyone can run. For defenders, that means bugs get found and weaponized faster, and the patch window shrinks.
How the chains work
- Chrome: V8 heap corruption, then a V8 memory-sandbox escape that defeats ASLR and uses ROP to take the renderer, then a CacheStorage race to learn the privileged process layout, then a FedCM use-after-free to run code outside the sandbox.
- Safari: a JavaScriptCore use-after-free plus read/write outside the Gigacage, a WebContent sandbox IPC bug to read history and cookies, and a memory write that switches off the same-origin policy, with no arbitrary code execution needed.
- Android: three bugs chained on a physical Pixel 9 to get past USB lock-screen limits, pairing authorization and the six-digit code, then pull photos off a locked phone.
- Windows and Linux: a kernel QUIC out-of-bounds read (remote crash) and an MPTCP race-induced use-after-free (zero-click root).
The method runs many scanning agents in parallel, values each by the extra bugs it finds, and runs automated variant analysis on every confirmed finding.
Numbers and benchmarks
There is no standard benchmark here; all figures are Anthropic's own: 62 Chrome CVEs, all critical or high, including 13 sandbox escapes and 21 renderer compromises; the Linux PoC leaks a kernel pointer in about 48 minutes and runs a root command about 5 minutes later. The model name, human share, failed attempts and compute cost were not disclosed, so no comparison with public models is possible.
What developers should do
- Update Chrome to 156 or later, move Linux servers to stable kernels with the CVE-2026-98432 backport, and patch Windows for CVE-2026-33096.
- Follow Anthropic's advice to scan at PR time, not only work down the backlog; it has released a Claude Code security plugin for this.
- Qualifying security teams can apply to Anthropic's expanded Cyber Verification Program for stronger models and lighter blocking.
- Read the Anthropic research post.
Benchmark side-by-side against alternatives, or calculate monthly token cost vs subscription break-even.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.