What happened
Anthropic's Frontier Red Team documented five exploit chains produced by an unreleased research model with 'little human involvement': a Chrome chain (four bugs: V8 corruption, renderer sandbox escape, CacheStorage race, FedCM use-after-free) running code outside the sandbox from one page load; a Safari chain turning off the same-origin policy for cross-site data read; and a Linux chain (multipath TCP listener) achieving root over the network with no login. Anthropic reported to vendors first under a 90-day coordinated disclosure.
Why it matters
Until now, chaining several independent bugs into a working exploit required specialist human teams. A single frontier model performing the whole chain, with only initial prompting, changes the offensive landscape: it compresses the time from CVE to weaponized exploit and raises the bar for the browsers, OSes and embedded browser surfaces that AI coding agents rely on. It also signals that frontier models are a dual-use cyber capability.
Attack vector
Dangerous-capability red-team evaluation, not an in-the-wild attack: the model was prompted to find and chain vulnerabilities, then produced working exploit chains with minimal human involvement (Chrome chain used four separate bugs to escape the sandbox; Linux chain leaked a KASLR address and reused a race to reach a root shell). All flaws were reported and patched before publication; no real-world exploit observed.
Affected systems
Anthropic unreleased internal research model (opaque to public); chains against Chrome (62 CVEs, Chrome 156), Safari/iOS (iOS 26.5.2), Android, Windows (CVE-2026-33096) and Linux multipath TCP (CVE-2026-98432).
Mitigation
All upstream fixes are already released (Chrome 156, iOS 26.5.2, kernel CVE-2026-98432, Windows CVE-2026-33096). Defenders should patch the relevant browser/OS components; treat this as evidence that models can now generate cross-component exploit chains autonomously.