Anthropic says an internal model chained exploits across Chrome and kernels

Anthropic published a Frontier Red Team writeup claiming an unreleased internal model found vulnerabilities and chained them into five working exploit chains across Chrome, Safari, Android, Windows, and Linux. It lands the same week Google Project Zero's Fuzzilli-vs-BigSleep comparison gave the first production read on LLM bug-finding — so it's worth separating what is independently checkable here from what rests on the vendor's own account. This is the AI/LLM security beat, where that distinction matters most.

What Anthropic claims

Per the post, each chain started "after initial prompting" and reached remote code execution or a comparable impact with little to no user interaction:

• Chrome: a one-click chain launching Calculator from a default build on macOS. Anthropic says 62 CVEs were assigned and patched as of Chrome 156, all critical or high, including 13 sandbox escapes and 21 renderer-compromise bugs.
• Safari: a one-click, data-only chain that disables the same-origin policy and reads history, cookies, and session data. No CVE listed.
• Android: a lock-screen bypass extracting photos from a physical Pixel 9. No CVE listed.
• Windows: a remote kernel DoS in the QUIC/HTTP-3 path, tracked as CVE-2026-33096, with an estimated "several million" exposed servers.
• Linux: a zero-click RCE in the kernel's multipath TCP code, CVE-2026-98432, patched upstream and backported to stable branches. Anthropic clocks the Linux chain at 48 minutes to leak a kernel pointer and about five more to reach a shell.

What checks out — and what doesn't

Two claims are verifiable against third parties, and they hold: Chrome 156 release notes credit "Xinyang Ge of Anthropic, assisted by Claude" for some fixes, and Apple credits "Milad Nasr and Nicholas Carlini with Claude, Anthropic" in the relevant security content. Vendor credits are hard to fake, and these exist.

The caveats are real and worth stating plainly:

1. The capability framing is self-reported. "Little human involvement" is Anthropic's characterization; the post does not break down what humans did at each step, and for Windows the researchers supplied the binary and asked the model to reverse-engineer it.
2. Two CVE records don't match the story. The public record for CVE-2026-33096 describes an HTTP.sys issue and credits no finder, while Anthropic describes a QUIC kernel bug. The CVE-2026-98432 record describes an IPv4 TCP fix, not the multipath-TCP chain Anthropic claims. The link between those CVEs and Anthropic's chains comes only from Anthropic's post.
3. The Safari and Android fixes carry no CVE in the post, and independent reporting (The Hacker News) found no public record of the Android fix.

Why it matters

Strip the framing and a concrete fact remains: vendor credits confirm an Anthropic-plus-model pipeline contributed real, patched browser bugs. That is a meaningful data point for defenders — automated bug-finding is producing shipped fixes, not just demos. But the leap from "contributed CVEs" to "an AI chained a zero-click kernel RCE largely on its own" is exactly where the records get thin, and a security team should hold it at arm's length until the per-step detail and the CVE descriptions line up. The honest read, matching Project Zero's: these systems are now part of the bug-finding pipeline, and the hype runs ahead of the evidence in both directions.