Anthropic's Frontier Red Team Says Unreleased Claude Chained Flaws Into Working Chrome, Safari, Android, Windows and Linux Exploits

Anthropic's Frontier Red Team disclosed that an unreleased Claude research model built end-to-end exploit chains across five platforms, including a zero-click remote-root Linux chain (CVE-2026-98432, CVSS 9.8), a one-click Chrome escape combining four V8 and sandbox bugs patched in Chrome 156, a Safari same-origin break through WebKit's Gigacage, a locked-Pixel-9 bypass over USB, and a Windows QUIC crash (CVE-2026-33096). All flaws were reported to vendors ahead of patches, and the paper argues frontier models can now 'prove' novel vulnerabilities by producing working exploits with little human involvement.