Anthropic says unreleased Claude model built five attack chains in major software

Anthropic says an unreleased, internal Claude research model found critical vulnerabilities in browsers and operating systems and turned them into five attack chains. According to the company's research post, those chains led to remote code execution and other critical impacts with "little to no user interaction."

The post does not say which model version built which chain. That is the first thing I would like on the record, and it is not there.

What the model is said to have done

The headline demo is Chrome. Anthropic says Claude, after initial prompting, wrote a full exploit chain that executes arbitrary code as the user, outside the browser's sandbox. The proof of concept launches the Calculator app on macOS from a stock default-configuration Chrome within seconds of a page loading. The chain strings together a heap corruption bug in V8, a second flaw to escape V8's sandbox and defeat ASLR using ROP, a race condition in CacheStorage, and a use-after-free in FedCM.

The rest of the list:

• Safari: a one-click, data-only chain that bypasses the same-origin policy without arbitrary code execution, reaching history, cookies and session databases.
• Android: a lock screen bypass on a physical Google Pixel 9 that extracts photos and personal data, built from three chained flaws across USB restrictions, device pairing and fallback USB transfers. Google addressed it.
• Windows: a remote denial-of-service flaw in the kernel's QUIC implementation, CVE-2026-33096, found through binary analysis in Ghidra. Anthropic says it could crash and restart listening HTTP/3 servers, which it estimates number several million.
• Linux: a zero-click remote code execution bug in the kernel networking stack, CVE-2026-98432, via a use-after-free in multipath TCP. Anthropic says it took 48 minutes to defeat KASLR and 5 minutes to run shell commands as root. It was patched upstream and backported.

Anthropic adds local privilege escalation flaws in OpenBSD, FreeBSD and Linux, plus sandbox escapes in popular sandboxing infrastructure and "numerous vulnerabilities in important web applications."

The numbers, and the ones missing

The most concrete numbers concern reported vendor fixes. Anthropic says Google has assigned and patched 62 CVEs as of Chrome 156, all rated critical or high, including 13 sandbox escapes and 21 flaws that could have compromised the renderer. Apple, per the post, acknowledged the Safari report the same day it was submitted and shipped a fix that is available to users.

I would still put the 62 in context. A CVE count measures bookkeeping, not difficulty. The post, as summarized, gives no false-positive rate, no count of how many candidate bugs were discarded, and no account of how much human effort sat between "initial prompting" and a working chain. Those are the denominators. A numerator with no denominator is a press release with a stack trace.

The disclosure terms are at least stated plainly. Anthropic says it reported each flaw under a coordinated policy that gives developers 90 days to patch and a further 45 days before it discusses details beyond a public advisory. It also says it built security guidance into its own development process through a Claude Code plugin, which it has released publicly.

Where this sits in Anthropic's own timeline

This is not the first time Anthropic has made this argument. On April 7, 2026, it announced Project Glasswing with Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks. It committed up to $100M in usage credits for Claude Mythos Preview and $4M in donations to open-source security groups.

Anthropic said then that Mythos Preview found a 27-year-old remote crash bug in OpenBSD and a 16-year-old vulnerability in FFmpeg. It also said the model chained Linux kernel flaws to reach root autonomously. On the CyberGym vulnerability reproduction benchmark, it reported 83.1% for Mythos Preview against 66.6% for Claude Opus 4.6. That is a vendor's own table, and a useful one, but a reproduction benchmark is not the same as building a working browser exploit chain.

Anthropic also said it does not plan to make Mythos Preview generally available. Its stated goal is to let users "safely deploy Mythos-class models at scale," with safeguards to detect and block dangerous outputs planned for an upcoming Claude Opus model. After credits run out, participants pay $25 per million input tokens and $125 per million output tokens.

On October 6, Anthropic expanded its Cyber Verification Program into three access tiers, giving qualified security professionals access to Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1. Existing Glasswing members move to the Specialized Access tier. The announcement gives no criteria for getting into those tiers.

What to watch

The Hacker News reported an evaluation incident in which Mythos Preview followed a researcher's instructions, escaped a secured sandbox computer, devised a multi-step exploit to gain broad internet access, and emailed the researcher, who was eating a sandwich in a park. It was flagged as a "potentially dangerous capability" to bypass its own safeguards. How the escape worked is not described. Show me the eval, not the vibe.

Three things to watch. First, whether Anthropic names the model behind each chain. Second, whether independent researchers can reproduce any of the five. Third, whether the Opus safeguards arrive and whether anyone tests them against the Chrome and Linux chains. Until then, the reported vendor patches are, to my eye, the strongest evidence in the story, but the patch accounts here also come from Anthropic.