AI Coding Live News

Anthropic's Frontier Red Team details five exploit chains an unreleased internal Claude model built for Chrome, Safari, Android, Windows and Linux; Chrome 156 fixes 62 CVEs

Anthropic's Frontier Red Team published a research post on Oct 27 saying it spent the past few months using an unreleased internal research model to find critical vulnerabilities in browsers and operating systems, and that after initial prompting Claude wrote five full exploit chains: one-click remote code execution with a sandbox escape in Chrome, a same-origin policy bypass in Safari, data extraction from a locked Android phone over USB, a remote denial of service against Windows HTTP/3 (QUIC), and zero-click root code execution on Linux servers with a multipath TCP listener. Anthropic says Google assigned 62 CVEs to its reports, all critical or high, fixed as of Chrome 156, and every issue went through coordinated disclosure and has been fixed. The model's name, the amount of human involvement and the compute cost were not disclosed.

Anthropic's Frontier Red Team details five exploit chains an unreleased internal Claude model built for Chrome, Safari, Android, Windows and Linux; Chrome 156 fixes 62 CVEs

Key Takeaways

  • The Chrome chain links 4 bugs: V8 heap corruption, a V8 sandbox escape that defeats ASLR, a CacheStorage race condition and a FedCM use-after-free; the PoC launches Calculator within seconds of a page loading in default Chrome on macOS
  • Per Anthropic, Google assigned 62 CVEs to its reports, all critical or high, including 13 sandbox escapes and 21 renderer-compromise bugs, fixed as of Chrome 156
  • The Windows kernel QUIC out-of-bounds read is CVE-2026-33096, with likely several million exposed servers by Anthropic's estimate; the Linux MPTCP zero-click root bug is CVE-2026-98432, where the PoC leaks a kernel pointer in about 48 minutes and reaches root command execution about 5 minutes later
  • Method: many parallel scanning agents scored by the extra vulnerabilities they add, with coverage tracking and automated variant analysis on every confirmed finding; Anthropic recommends scanning at PR time and has released a Claude Code security plugin
  • The model is an unnamed internal research model; Anthropic did not publish the share of human work, failed attempts or compute cost
Read full story
Linked Models & Agents:
⚡ Claude (unreleased internal research model)🤖 Claude Code🌐 Anthropic🌐 Google🌐 Apple🌐 Microsoft

Anatomy: an open-source Claude Code skill that turns technical ideas into interactive isometric machine figures

Anatomy (MIT) is an Agent Skill that has Claude Code invent a physical machine whose mechanism embodies a concept, then build it as an interactive isometric SVG/WebGL/3D (beta) figure with its own geometry audit and headless-Chrome self-checks. Created Oct 8, v1.0.0 shipped Oct 10, ~1,970 stars and 150 forks so far.

Anatomy: an open-source Claude Code skill that turns technical ideas into interactive isometric machine figures

Key Takeaways

  • One-line install: npx skills add wheresryan22/anatomy -g -a claude-code, then /anatomy <idea>
  • Zero dependencies: kit uses only Node built-ins (Node 20.10+); React output needs React 18+
  • Three modes: SVG, SVG+WebGL shaders (fire, water, caustics), 3D (beta); 8 complete examples in repo
  • Self-verification: kit/audit.mjs proves no part intersects; headless-Chrome scripts capture and check every joint
  • Author-reported perf: small 3D figures at 60 fps; 380-part stress hand ~20 fps; full 3D orbit audit of 30 parts takes 15–20 min
Read full story
Linked Models & Agents:

Claude Code 2.1.282: maxProseWidth, Chrome with managed MCP, plus resume/thinking and gateway readiness fixes

Anthropic shipped Claude Code v2.1.282 on 2026-09-24: maxProseWidth caps prose in wide terminals, allowClaudeInChromeWithManagedMcp lets claude --chrome coexist with exclusive managed-mcp.json, and store.readiness_grace_seconds keeps Apps Gateway /readyz up through brief Postgres failovers—plus many fixes for --continue/--resume dropping extended thinking, redacted_thinking 400s, and managed permission blocks.

Claude Code 2.1.282: maxProseWidth, Chrome with managed MCP, plus resume/thinking and gateway readiness fixes

Key Takeaways

  • maxProseWidth caps prose width; tables/code keep full width
  • allowClaudeInChromeWithManagedMcp for Chrome + exclusive managed-mcp.json
  • store.readiness_grace_seconds for Apps Gateway /readyz through short Postgres outages
  • Resume/continue and redacted_thinking 400 fixes; drop thinking blocks and retry once when needed
  • Install @anthropic-ai/[email protected] (release 2026-09-24T18:38:05Z)
Read full story

Moonshot ships Kimi Browser Extension: sidebar navigate/fill forms, record steps as Skills

Kimi.ai (@Kimi_Moonshot) launched the Kimi Browser Extension (formerly Kimi WebBridge): chat with Kimi in a browser sidebar to navigate sites, fill forms, and finish tasks. Record repetitive steps once as a Skill and let Kimi replay them next time. Available now at kimi.com/products/kimi-browser-extension and the Chrome Web Store.

Key Takeaways

  • Sidebar chat drives site navigation, form filling, and browser task completion.
  • Record repetitive flows once as Skills for Kimi to replay later.
  • Live on the product page and Chrome Web Store (upgrade from WebBridge).
Read full story
ADSponsored

Interceptor: CLI and MCP that drive your signed-in Chrome/Brave/Safari session and macOS apps

@DanKornas highlighted Interceptor (github.com/Hacker-Valley-Media/Interceptor), an agent browser and macOS control stack: one CLI plus extension drives your existing Chrome/Brave/Safari session (cookies, logins, tabs intact), with page actions, passive network capture, record-and-replay, and macOS accessibility/trusted input plus on-device vision/speech. Wires into Claude Code, Codex, Gemini CLI, and Cursor.

Interceptor: CLI and MCP that drive your signed-in Chrome/Brave/Safari session and macOS apps

Key Takeaways

  • Drive existing Chrome/Brave/Safari sessions instead of a blank automated profile.
  • Passive capture of fetch/XHR/SSE/WebSocket traffic plus record-and-replay.
  • macOS app control; wires Claude Code, Codex, Gemini CLI, and Cursor.
Read full story

ChatGPT desktop in-app browser now supports Chrome extensions with enterprise deploy

OpenAI engineer James Sun announced that the ChatGPT desktop app’s in-app browser (IAB) now supports Chrome extensions. Users can install, pin, and use everyday extensions such as 1Password while working inside ChatGPT. Enterprise admins can centrally deploy and manage extensions to meet security requirements. The update strengthens ChatGPT desktop as a workstation and cuts context-switching between a separate browser and the assistant.

Key Takeaways

  • ChatGPT desktop in-app browser can install, pin, and run Chrome extensions (e.g. 1Password).
  • Enterprise admins can centrally deploy and manage extensions for security requirements.
  • Keeps everyday extension workflows inside ChatGPT instead of bouncing to another browser.
Read full story
Linked Models & Agents:
⚡ chatgpt🌐 OpenAI

Cline ships jev-browser plugin: give TypeSafe Jev a background Chrome in Desktop

Cline released a Marketplace plugin named jev-browser that gives TypeSafe Jev a background Chrome inside Cline Desktop. After installing and saving a Vercel AI Gateway API key, browser tasks can launch Chrome in the background; the team says results have been striking.

Key Takeaways

  • Install jev-browser from Cline Desktop Marketplace under Customize > Plugins.
  • Save a Vercel AI Gateway API key to ~/.cline/plugins/cline-jev-browser.config.json and restart.
  • Browser tasks launch Chrome in the background, pairing Jev decisions with real web actions.
Read full story

TechCrunch: Abliteration.ai commercializes guardrail removal, hosts abliterated GLM-5.3

TechCrunch reports startup Abliteration.ai turned the long-standing open-source abliteration technique (orthogonalization that removes refusal tendencies) into a hosted browser/API service, including an abliterated build of Z.ai's recent open-weight GLM-5.3. The company says it targets "offensive cyber, red-teaming, and agent testing work other models refuse to do." TechCrunch created a free account and says the abliterated GLM-5.3 complied with requests for a Chrome password-stealer script and a protocol for culturing a dangerous human pathogen at home. The platform offers a customer-side moderation layer and keeps some limits (e.g. suicide instructions in testing) but has no full KYC beyond logging the payment card. Safety researchers (including CivAI) warn scaled access could enable harm; some red-teamers say they still rely more on fine-tuning open models and that abliteration can reduce capability.

Key Takeaways

  • Commercial hosted abliterated open-weights, including GLM-5.3, via browser/API
  • Pitch: offensive cyber, red-team, agent testing; TechCrunch saw high-risk prompts complied with
  • Debate: lowers misuse friction vs helps defenders; no full KYC yet
Read full story

Google DeepMind Unveils Gemini 3.8 Flash and Flash Cyber for Agents and Autonomous Patching

Google DeepMind launched Gemini 3.8 Flash and a security-specialized 3.8 Flash Cyber. Flash is Google’s most intelligent Flash yet, with gains over 3.7 Flash on software engineering, agentic tasks, and multi-step reasoning; Flash Cyber targets vulnerability detection and autonomous patching, producing 2.6x more valid fixes in Chrome codebase tests.

Key Takeaways

  • 3.8 Flash is rolling out in Antigravity, the API via Google AI Studio and Android Studio, Gemini App, and Search AI Mode
  • 3.8 Flash Cyber generates deployable patches in minutes inside an org’s cloud and leads CyberGym autonomous-finding benchmarks
  • The Fairwind Program gives national cyber authorities and critical-infrastructure partners early defensive access
Read full story

Google DeepMind Unveils Gemini 3.8 Flash and Flash Cyber

Google DeepMind launched Gemini 3.8 Flash, its most intelligent workhorse yet, and 3.8 Flash Cyber for defensive cybersecurity. Flash improves software engineering, agentic tasks, and multi-step reasoning over 3.7 Flash, with a native video-plus-coding loop in Antigravity. Flash Cyber leads on autonomous vulnerability detection and patching, producing 2.6× more valid Chrome fixes than top commercial models.

Key Takeaways

  • 3.8 Flash is a cheaper, effort-controlled workhorse for coding and long multi-step agent workflows
  • 3.8 Flash Cyber generates deployable patches in minutes and is prioritized for governments via the Fairwind Program
  • Rolling out now in Antigravity, the Gemini API, Android Studio, Gemini App, and Search AI Mode
Read full story
ADSponsored

Google Ships Gemini 3.8 Flash and 3.8 Flash Cyber for Agents and Autonomous Patching

Google DeepMind launched Gemini 3.8 Flash and a dedicated cybersecurity sibling, 3.8 Flash Cyber. 3.8 Flash is Google’s most intelligent Flash yet, with large gains over 3.7 Flash in software engineering, agentic tasks, and multi-step reasoning, rolling out in Antigravity, the Gemini API, and Gemini App. Flash Cyber leads CyberGym and produced 2.6x more valid fixes on Chrome codebases, with trusted access via the Fairwind Program.

Key Takeaways

  • 3.8 Flash is the third Flash upgrade in six weeks, targeting SWE, agents, and multi-step reasoning
  • 3.8 Flash Cyber generates deployable security fixes in minutes inside an organization’s cloud
  • The Fairwind Program gives national cyber authorities and critical-infrastructure operators trusted access
Read full story

Nous Research Ships Real-Profile Browsing for Hermes Agent with Managed Chrome Session Cloning

Nous Research shipped real-profile browsing for Hermes Agent, allowing users to optionally grant the agent access to a managed copy of their logged-in Chrome profile for authenticated workflow execution.

Key Takeaways

  • Shifts browser agents from anonymous web scraping into authenticated, logged-in user workflow automation;
  • Security-first isolation: operates on a sandboxed copy of the Chrome profile with strict opt-in controls;
  • High community adoption signaling strong demand for secure, authenticated browser-use autonomous agents.
Read full story
Linked Models & Agents:
⚡ Nous Hermes 3

Claude Cowork Launches Built-in Browser: Desktop Native Web Browsing & Automation, Claude in Chrome Generally Available

Anthropic announced that Claude now features a built-in browser inside Cowork. When a task touches a website, a side-panel browser opens so Claude can navigate, fill forms, and finish workflows in an isolated environment. Concurrently, Claude in Chrome is generally available across all paid plans.

Key Takeaways

  • Cowork side-panel browser enables Claude to navigate web interfaces and execute multi-step automations.
  • Isolated execution inside desktop client protects personal credentials and logins.
  • Claude in Chrome extension is now generally available for all paid plans.
Read full story