Anthropic's own offensive desk just published working chains across Chrome, Safari, Android, Windows, and Linux. The actor is Frontier Red Team. The model is an unreleased internal research build. The 27 October 2026 post is careful about who typed the prompts, and blunt about who wrote the exploit code.
Frontier Red Team's research Claude wrote five working chains
Anthropic says humans set goals and steered the campaign, then the internal research model authored the exploit material. Five chains are disclosed.
Chrome is the densest result. The model produced a one-click remote code execution path that stacked V8 heap corruption, a sandbox escape, a CacheStorage race, and a FedCM use-after-free. Anthropic ties the campaign to 62 CVEs patched in Chrome 156, including 13 sandbox escapes. That volume is the operational signal for browser vendors: a single directed research sprint fed a large Stable-channel fix wave.
Safari took a different shape. The disclosed path is a same-origin-policy bypass built as a data-only chain through a JavaScriptCore use-after-free, Gigacage handling, and IPC. Anthropic presents it as memory-corruption craft that still yields a browser security-boundary break without a classic shellcode-looking finale.
On Android, the team reports a lock-screen bypass that extracts data over USB on a Pixel 9. The physical-adjacent path matters for device fleets that treat USB debugging and lock-screen assumptions as enough.
Windows contributed CVE-2026-33096: a remote denial of service through a kernel QUIC out-of-bounds read. Linux contributed the headline privilege jump, CVE-2026-98432, a zero-click multipath TCP root remote code execution. Anthropic's timeline says the model spent roughly 48 minutes leaking KASLR, then obtained a shell.
Coordinated vulnerability disclosure ran on a 90-day fix window plus 45 days of grace. Named CVE identifiers appear where vendors assigned them; the Chrome bundle is summarised by Anthropic as the 156 patch set, without a single CVE label covering the whole chain.
Lab-authored exploits landed the same week as product security scaffolding
This disclosure is Anthropic speaking as the lab that ran the campaign, which separates it from third-party harness write-ups that only rented Claude. The artefacts are patched CVEs and vendor confirmations, so the story clears the bar that advisory-only LLM security posts often miss.
Anthropic pairs the research with product moves: an expanded Cyber Verification Program covering Opus 5.5, Sonnet 5.5, and Mythos 5.1, plus a Claude Code security plugin aimed at catching issues earlier in agentic coding workflows. The research model stays internal. The verification programme and plugin are the public tools customers can actually buy against.
Scanner diversity and pull-request-time scanning are the process lessons Anthropic emphasises. One model, one scanner, or one late-stage audit would have missed pieces of these chains. That reading travels even if a buyer never touches the unreleased research checkpoint.
Internal research model; public programme expands on 5.5-class Claude
The offensive model described here is unreleased. No weights, API SKU, or open eval harness for that checkpoint are disclosed in the 27 October post. Activity that buyers can track sits on the public Claude line: Opus 5.5, Sonnet 5.5, and Mythos 5.1 entering a broader Cyber Verification Program, and the Claude Code security plugin shipping into the coding-agent surface.
Maturity reading for defenders: treat the five chains as confirmed research outcomes under CVD. Treat any marketing claim that "Claude finds zero-days for you" as referring to programme tooling and plugin workflows, until Anthropic documents which public models reproduce which classes of bug without the internal research build.
Patch the named trains, then wire PR-time scanning into agent repos
Browser and OS operators should confirm Chrome 156-class fixes, Safari updates covering the disclosed JavaScriptCore path, Pixel 9 and wider Android lock-screen USB guidance, Windows builds that absorb CVE-2026-33096, and Linux kernels patched for CVE-2026-98432 / multipath TCP. Those are the Monday patches.
Security engineering leads evaluating Anthropic should ask which Cyber Verification Program tier maps to their deployed Claude SKU, and whether the Claude Code security plugin runs on every repository that lets agents edit and execute. Teams building their own offensive research loops should copy the process lesson Anthropic states in plain terms: diverse scanners and PR-time checks beat a single end-of-sprint model pass.
Buyers who only need a chat model can ignore the internal research checkpoint. Buyers who sell agentic coding into regulated environments cannot ignore the verification programme language now attached to 5.5-class models.
Human prompting, single-scanner faith, and copying the research SKU
Anthropic is explicit that humans prompted and the model wrote exploits. Briefings that erase the human steer will overstate autonomy and understate the operator skill still required. Teams that buy one commercial scanner and skip PR-time agent scanning recreate the coverage gap the post warns about.
A second failure mode is assuming the unreleased research model is what shipped in Opus or Sonnet. It is not disclosed as a public endpoint. A third is treating the Windows QUIC issue as "only DoS" while leaving multipath TCP Linux hosts unpatched because the Chrome narrative dominated the headline.
CVD clocks also cut both ways. Ninety-plus-forty-five days is orderly for vendors. Attackers who independently find overlapping bugs do not wait for the blog.
Price the verification programme against the patched CVE list
The durable artefacts from 27 October are the patched Chrome 156 wave, CVE-2026-33096, CVE-2026-98432, and Anthropic's public verification-plus-plugin commitments. The open Monday question for customers is whether their Claude deployment is enrolled in the expanded Cyber Verification Program and whether agent-written patches hit a scanner before merge.