Anthropic's unreleased Claude builds five exploit chains — 62 Chrome CVEs assigned
| Date | 2026-10-27 |
|---|---|
| Category | Frontier Models |
| Judgement | Refutes |
| Gauge weight | 2 / 3 |
| Source | Anthropic Frontier Red Team |
Summary
In a research post dated October 27, 2026, Anthropic's Frontier Red Team reported that an unnamed, unreleased internal research model had, over the past few months, found vulnerabilities in Chrome, Safari, Android (Pixel 9), Windows and the Linux kernel and chained them into working exploits. In Chrome it chained 4 bugs into a one-click sandbox escape, and on Anthropic's report Google assigned 62 CVEs (all critical/high, 13 sandbox escapes), patched in Chrome 156. On Linux it achieved a zero-click remote root, CVE-2026-98432 (CVSS 9.8), in 53 minutes in total (48 minutes for the KASLR leak plus 5 minutes to root command execution).
A/B Impact Analysis
This record is filed as refuting. The watch judgement saw a reconfirmation of the existing pattern, multi-day autonomy where an external verifier exists, but recorded that offensive capability at this level strengthens release and security friction, such as limited releases and security-driven pretraining pauses, as delay pressure on the timeline. The model name, prompt logs and human intervention were not disclosed, so verification is impossible, and no success rates were given.