Anthropic's Unreleased AI Built Working Break-Ins for Chrome, Safari, Android, Windows and Linux. The Holes Are Already Patched.

Rating as of October 29, 2026: 6/10 · Eyebrow Raised

Finding a security hole is one skill. Turning several holes into an attack that actually works, start to finish, has been the job of a small number of elite teams. Anthropic says its AI can now do that part too.

What changed

On October 27, Anthropic's Frontier Red Team (the in-house group that tests what its models can do in risky areas) published a report on what "an unreleased, internal research model" found over the past few months [1]. The model has no public name, and Anthropic hasn't said whether it will ever be released [1][2].

The report describes five "attack chains." An attack chain strings several separate flaws together until they add up to real control of a device or its data. Anthropic's five [1]:

• Chrome: four bugs chained together so that a malicious web page could run its own program on a Mac "within seconds of the page loading, without any further user interaction." Google has assigned 62 CVEs (official vulnerability ID numbers) from Anthropic's Chrome reports, all rated critical or high, and fixed them as of Chrome 156.
• Safari: a chain that lets one website read another site's history, cookies and session data. Apple has published a fix.
• Android: a way to pull photos and personal information off a locked Google Pixel 9 over a USB connection, the kind of thing a phone thief would want. Google has addressed it.
• Windows: a flaw that lets someone crash a machine remotely with a few network packets (CVE-2026-33096). Anthropic estimates "several million such servers" are listening on the internet.
• Linux: a "zero-click" attack, meaning the victim doesn't have to do anything, that ends with full administrator control (CVE-2026-98432). In Anthropic's test, the first stage took 48 minutes and running commands took about five more.

How much did people help? Each chain started with "initial prompting" from a researcher, and for Windows, researchers handed the model the software and asked it to take it apart [1]. Anthropic also built a system that runs "large numbers of scanning agents in parallel" [1]. Anthropic's summary: this work has "historically been the domain of few specialist teams," and now "it's something models can do with little human involvement" [1]. The report doesn't say how much back-and-forth each chain took.

Every flaw went through Anthropic's coordinated disclosure process, which gives companies 90 days to fix a problem before details come out [1]. Cyber Security News checked the public records and found Chrome 156's release notes credit "Xinyang Ge (Anthropic), assisted by Claude" for several fixes [2]. It also found that the public descriptions of the Windows and Linux bugs don't quite match Anthropic's (one names a different Windows component, the other doesn't mention the part of Linux Anthropic describes), so for those two the details rest on Anthropic's word for now [2].

What's confirmed: the flaws were real enough to get fixed. What isn't: nobody outside Anthropic has tested the model itself, and no outside experts have weighed in on how impressive the chains are.

Why it matters

Until now, most of what we've covered about AI and security has been about AI finding problems, like the 129,000 flaws Anthropic's partners found or the PHP holes. Finding a bug is like noticing a window that doesn't latch. Building a working chain is like getting through the window, past the alarm and into the safe. The second part is much rarer, and it's what turns a bug report into an actual attack. Anthropic is saying an AI can now do both, against the software on most of our phones and laptops.

The good news is real: these particular holes were closed before anyone could use them, which is the whole point of letting defenders go first. Anthropic says enabling defenders is about "giving them a headstart on patching systems before attackers do" [1].

The worry is how long the head start lasts. A month ago Anthropic wrote that an open model anyone can download, GLM-5.3, was already close to its own earlier top model at building exploits, and cited the U.S. government's AI testing center as finding that GLM-5.3 trails the leading U.S. models by about four months [3]. If that gap holds, the skills in this report won't stay behind a locked door forever. The practical takeaway for the rest of us is boring but true: install updates when your phone and browser ask.

What you can probably ignore

"An AI just hacked Chrome, Safari, Windows and Linux." These were lab tests run by the company that built the model, and every flaw was reported to the vendor and fixed before Anthropic talked about it [1][2]. No one was attacked.

"Every phone and computer is now wide open." The Chrome bugs are fixed as of Chrome 156, Apple and Google have shipped their fixes, and the Linux fix was added to supported versions [1]. If your devices are up to date, these specific holes are closed.

"Anthropic is about to release a super-hacker AI." The model is unreleased, and Anthropic hasn't announced any plans for it [1][2]. Its public models only come with loosened cyber restrictions for vetted security professionals [1].

Why it earned this rating

Reasons for a higher number: this is a clear jump in what AI can do, not just a dramatic description. Complete, working attacks on the most widely used software in the world, including one that needs no action from the victim, used to take rare human experts [1]. Anthropic itself says it now takes "little human involvement" [1]. And the gap between the frontier and freely downloadable models is measured in months [3].

Reasons for a lower number: nobody was harmed. The model isn't public. Every flaw was fixed first [1][2]. Humans pointed it at each target [1]. And most of the evidence comes from Anthropic, with a couple of details that don't yet line up with the public records [2].

The call: I gave it a 6, the same as Google's Gemini 4 Argon restricted launch: a meaningful new capability, handled carefully. I thought about a 7 because building working attacks is a bigger step than finding flaws, but the things that usually push a story into Pay Attention (real-world use, harm, or the capability getting loose) aren't here.

What I'm watching next

• Whether the model gets released, and with what safeguards.
• Outside confirmation, from the vendors or independent researchers, especially on the Windows and Linux bugs where the public records differ from Anthropic's description.
• Other labs and open models matching it. If a downloadable model can build chains like these, this moves up fast.
• Anyone using these exact flaws on devices that haven't been updated.

Bunker Check

Current rating: 6/10 · Eyebrow Raised

Direction: Holding, leaning up

Could move higher if: a model with these skills is released with weak safeguards, an open-weight model matches it, or attackers are caught using AI-built exploit chains in the wild.

Could move lower if: outside researchers find the chains needed much more human help than described, or defenders keep finding and fixing flaws faster than attackers can use them.

Bunker status: the shovel stays in the garage. The "Update and restart" button, however, has earned a little respect.

Sources

1. Anthropic Frontier Red Team, "Discovering and exploiting vulnerabilities in critical, real-world software with Claude," October 27, 2026 (primary source). https://www.anthropic.com/research/discovering-vulnerabilities-with-claude
2. Cyber Security News, "Claude AI Builds One-Click Chrome and Zero-Click Linux Exploit Chains, Bypasses Android Lock Screen," October 28, 2026. https://cybersecuritynews.com/claude-ai-builds-exploit/
3. Anthropic, "GLM-5.3 and the spread of advanced cyber capabilities," September 29, 2026. https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities