Anthropic's Unreleased AI Model Autonomously Built Working Exploits for Chrome, Safari, Android, Windows, and Linux

An unreleased Anthropic research model independently discovered and chained zero-day vulnerabilities into five working exploit packages targeting Chrome, Safari, Android, Windows, and Linux — with minimal human involvement. The disclosure represents the first confirmed case of an AI system generating novel, multi-stage exploit chains across major production software at a scale that rivals professional offensive security teams.

Anthropic's internal Frontier Red Team revealed the findings as part of a coordinated disclosure process. Every vulnerability was reported to the affected vendors before publication, and all patches were deployed before the report went public.

What the Model Did

The unnamed Claude research model — not available to the public — was given access to target software environments and tasked with finding security weaknesses. It did not just find individual bugs. It chained previously unknown vulnerabilities into complete, working exploit sequences: the kind of multi-step attack paths that allow an attacker to move from an initial foothold to full system control.

The Chrome exploit chain alone produced 62 assigned CVEs (Common Vulnerabilities and Exposures — the industry's official vulnerability tracking system). Of those, 13 were sandbox escapes — meaning the model found ways to break out of Chrome's security containment layer and reach the underlying operating system. All 13 were rated high or critical severity.

The other four chains targeted:

• Safari (Apple's browser)
• Android (Google's mobile OS)
• Windows (Microsoft's desktop OS)
• Linux (the kernel underlying most servers and Android devices)

Anthropic has not published the full technical details of those four chains, citing ongoing patch coordination.

Context: What Makes This Different

Security researchers have used AI tools to assist with vulnerability research for several years. What separates this disclosure is the degree of autonomy: the model identified targets, found flaws, and assembled them into working exploit chains without human researchers directing each step.

Prior demonstrations of AI in offensive security — including tools from Google's Project Zero and various academic labs — required significant human guidance. An AI that chains zero-days independently is a qualitatively different capability.

The Frontier Red Team is Anthropic's internal group responsible for testing its own models for dangerous capabilities before release. This model has not been, and will not be, deployed externally in its current form, according to Anthropic's disclosure.

Why Coordinated Disclosure Matters Here

Coordinated disclosure means a researcher privately reports a vulnerability to the vendor, waits for a patch, then publishes. It is the established norm for responsible security research. Anthropic followed it here — every flaw was patched before the report became public.

That said, the existence of the capability raises an immediate question: if a research model can do this, what happens when similar capability reaches adversarial actors, whether through open-weight models or through less scrupulous labs?

Google, Apple, and Microsoft have not commented publicly on the disclosure.

What This Means for the Industry

For software vendors: The volume and severity of what one AI model found in a limited engagement suggests that the economics of vulnerability discovery have shifted. Finding 62 CVEs in a single product used to require a large team over months. That timeline is compressing.

For enterprise security teams: Organizations that rely on vendors patching known CVEs before attackers find them are facing shorter windows. The case for proactive, AI-assisted internal red-teaming just got stronger.

For AI labs: This is a direct demonstration of the "dual-use" problem at the core of frontier AI development. A model capable enough to perform serious security research is also capable enough to be weaponized. How labs govern access to these capabilities — and how they communicate risk to the public — will face more scrutiny.

For regulators: The EU AI Act and the U.S. executive order on AI safety both identify cybersecurity as a high-risk domain for AI. This disclosure gives regulators concrete evidence to point to when debating what "dangerous capability" thresholds should look like.

What to Watch

Anthropic has not said when or whether a version of this model will be deployed, even in restricted form. Watch for follow-up technical disclosures from the affected vendors detailing the specific vulnerability classes the model exploited — that information will reveal how broadly applicable the technique is across other software targets.