Anthropic Frontier Red Team: five disclosed model-assisted exploit chains

Evidence record

Primary research account of separate Chrome, Safari, Pixel 9, Windows HTTP/3 and Linux MPTCP vulnerability chains with coordinated disclosure.

Read the original source ↗

Claim-level citations (10)

• supportsClaude-assisted Chrome research combined four browser trust-boundary failures: Anthropic describes one four-stage Chrome exploit chain ending in execution outside the browser sandbox, while reporting 62 patched CVEs across the wider research program rather than 62 complete chains.

  Anthropic report: Chapter 1, one-click remote code execution in Chrome; cumulative CVE count

• supportsClaude-assisted Chrome research combined four browser trust-boundary failures: Anthropic reports a controlled chain from V8 heap corruption through sandbox bypass, CacheStorage memory disclosure and FedCM use-after-free into native user-context execution on macOS. The demonstration required the vulnerable default Chrome build and a visited malicious page; user execution in the browser sandbox alone was insufficient. The final proof launched Calculator outside the browser sandbox without another click after page load.

  Anthropic report: Chapter 1, one-click remote code execution in Chrome; cumulative CVE count

• supportsClaude-assisted Linux MPTCP race led to remote root execution in a controlled test: Anthropic reports a research-chain Linux MPTCP kernel exploit that first leaks kernel information and subsequently reaches a root command in controlled conditions; the report does not document live compromise of arbitrary Linux hosts.

  Anthropic report: Chapter 5, Linux MPTCP zero-click exploit chain and CVE-2026-98432

• supportsClaude-assisted Linux MPTCP race led to remote root execution in a controlled test: Anthropic describes a Linux Multipath TCP handshake race leading from an information leak to a kernel use-after-free and a controlled root-command exploit. The attack depends on an affected kernel and an MPTCP listener reachable by the attacker; it is not a generic TCP remote-root issue. Researchers report a roughly 48-minute leak stage followed by a further exploit stage in the test configuration.

  Anthropic report: Chapter 5, Linux MPTCP zero-click exploit chain and CVE-2026-98432

• supportsClaude-assisted Pixel 9 research bypassed USB pairing on a locked physical phone: In the reported Pixel 9 demonstration, possession of the locked device and a connected USB host were prerequisites for bypassing pairing confirmation and accessing test photos; this was not a network-only attack.

  Anthropic report: Chapter 3, Android lock screen and USB pairing bypass

• supportsClaude-assisted Pixel 9 research bypassed USB pairing on a locked physical phone: Anthropic reports that Claude helped combine Android USB pairing and permission weaknesses to obtain data from a locked Pixel 9 in a laboratory scenario. The attacker had to physically possess the vulnerable phone and connect a USB host; this was not a remote zero-click exploit. The demonstration bypassed a six-digit pairing confirmation and used a raw-file fallback path to extract test photos.

  Anthropic report: Chapter 3, Android lock screen and USB pairing bypass

• supportsClaude-assisted Safari research changed cross-origin policy state without native code: Anthropic says its Safari chain changed same-origin enforcement and could read authenticated cross-origin responses without a native-code payload; those demonstrated browser capabilities are not a report of actual bank-account theft.

  Anthropic report: Chapter 2, Safari cross-origin data-only exploit and Apple remediation

• supportsClaude-assisted Safari research changed cross-origin policy state without native code: Anthropic describes a Safari chain using a JavaScriptCore TypedArray use-after-free, Gigacage escape and browser IPC to alter same-origin policy state in data memory. The demonstration requires a vulnerable Safari/WebKit build and an attacker page able to reach the reported browser primitives. The controlled exploit could access authenticated cross-origin response data through a browser policy mutation, without native shellcode execution.

  Anthropic report: Chapter 2, Safari cross-origin data-only exploit and Apple remediation

• supportsClaude-assisted Windows HTTP/3 research triggered a kernel crash, not code execution: The Windows research result concerns kernel HTTP/3 QUIC processing and a controlled crash or reboot after crafted packets, not command execution or a documented campaign against Windows users.

  Anthropic report: Chapter 4, Windows remote denial of service, CVE-2026-33096

• supportsClaude-assisted Windows HTTP/3 research triggered a kernel crash, not code execution: Anthropic says Claude helped reconstruct a Windows kernel HTTP/3 QUIC parsing defect that could be triggered by a small number of crafted packets. A vulnerable, reachable HTTP/3 implementation was required; systems with the affected service disabled have different exposure. The demonstrated consequence was a kernel crash or reboot through an out-of-bounds read rather than attacker command execution.

  Anthropic report: Chapter 4, Windows remote denial of service, CVE-2026-33096