Anthropic has revealed that an unreleased internal research model, part of the Claude family, successfully discovered and exploited critical vulnerabilities in some of the world’s most widely used software, including browsers and operating systems. The findings, detailed in a new research post, demonstrate the model's ability to construct sophisticated, multi-step attack chains that lead to remote code execution (RCE) with minimal user interaction. These exploits affect billions of users and serve as a bellwether for the cyber capabilities of frontier AI models.

Browser Exploits and Sandbox Escapes

The model generated a one-click RCE exploit chain for Google Chrome on macOS, launching the Calculator app without user interaction. This required chaining four distinct vulnerabilities: a heap corruption in V8, a sandbox escape to defeat ASLR, a race condition in CacheStorage, and a use-after-free in FedCM. Anthropic reported these findings to Google, resulting in 62 CVEs assigned and patched as of Chrome 156, all rated critical or high severity. In a similar feat for Apple’s Safari, the model bypassed the same-origin policy (SOP) using a data-only attack that never relied on arbitrary code execution. By exploiting a use-after-free in JavaScriptCore and defeating the Gigacage mitigation, the model gained read/write access to modify security flags. This allowed an attacker to read a user’s history, cookies, and even send authenticated requests to other domains, effectively compromising sensitive data like email and bank balances. Apple acknowledged the report and implemented a fix promptly.

Mobile and OS-Level Vulnerabilities

Beyond browsers, the model identified a lock screen bypass for Android that allowed data extraction from a stolen Google Pixel 9 without unlocking. The exploit combined source code analysis with reverse engineering of Google Play services, bypassing USB transfer restrictions and pairing authentication checks. Google has since addressed this issue. Additionally, the model discovered a remote denial-of-service vulnerability in the Windows kernel’s QUIC implementation, assigned CVE-2026-33096, which could crash servers via HTTP/3 requests. The most technically complex finding was a zero-click RCE in the Linux kernel’s networking stack, specifically within the multipath TCP listener. The exploit defeated KASLR remotely and hijacked control flow via a race condition-induced use-after-free bug. It took 48 minutes to leak a kernel pointer and another five to execute a shell command as root. This vulnerability, CVE-2026-98432, has been patched upstream and backported to all maintained stable kernel branches.

Implications for Security Workflows

Anthropic emphasizes that test-time compute scaling and scanner diversity are key to maximizing vulnerability discovery. The company built a platform running parallel scanning agents with varied strategies, from pure coverage to threat model-based analysis. While fixing existing backlogs is crucial, Anthropic argues that scanning at the pull-request stage is essential to prevent new vulnerabilities from entering the codebase. They have released a Claude Code plugin to integrate these security checks directly into development workflows.

Key Takeaways

  • Anthropic’s unreleased model achieved one-click RCE in Chrome and zero-click RCE in Linux, demonstrating advanced exploit chaining.
  • Google patched 62 CVEs in Chrome 156 following the discovery, all rated critical or high severity.
  • The model’s ability to reverse-engineer binaries and analyze source code allowed it to bypass complex mitigations like ASLR and Gigacage.
  • Anthropic recommends integrating AI-driven scanning at the PR stage to reduce the influx of new vulnerabilities.

The Bottom Line

This isn't just about finding bugs; it's about automating the creative destruction required to break modern software defenses. If Claude can chain exploits that human specialists struggle to identify, the asymmetry between attacker and defender is shifting rapidly. Defenders must adopt AI-driven verification now, or risk being outpaced by automated attackers. The model’s success in identifying a data-only attack in Safari highlights a nuanced understanding of memory safety that goes beyond simple pattern matching. It suggests that frontier models are developing a form of 'intuition' for how disparate system components interact, a skill previously exclusive to elite security researchers. This capability, when scaled across billions of lines of code, represents a fundamental change in the security landscape.