Finding one serious browser bug used to be a career highlight for a security researcher. Anthropic's Frontier Red Team now reports that an unreleased internal model, after initial prompting, built five working attack chains against Chrome, Safari, Android, Windows and Linux, and that its Chrome work alone led Google to assign 62 CVEs, every one rated critical or high. If that rate holds, the cost of finding exploitable flaws is falling for attackers and defenders alike.
The Chrome chain shows what chaining means in practice. The model linked four bugs, starting with memory corruption in the V8 JavaScript engine and ending with a use-after-free in FedCM, to run code outside Chrome's sandbox; the demonstration opened Calculator on a Mac within seconds of loading a page. The 62 CVEs, fixed by Chrome 156, include 13 sandbox escapes. Against Safari, a four-step chain switched off the same-origin policy without running any attacker code. On a locked Pixel 9, three chained bugs pulled photos and personal data, including a way around the six-digit pairing check. A kernel bug in Windows' QUIC code lets an attacker repeatedly crash servers answering HTTP/3, which Anthropic estimates puts several million at risk.
The Linux result is the starkest. A race condition in multipath TCP gave remote root with no user action: 48 minutes to leak a kernel pointer, then five more to get a root shell. Because a lost race does not crash the machine, an attacker can simply keep trying. The bug has been patched and backported to all maintained stable kernels. Anthropic gives vendors 90 days to patch and a further 45 before it publishes details beyond the advisory.
This lands alongside Google's launch of Gemini 4 Carbon a day later, which also leads with vulnerability finding and was first released only to defenders. Both labs are making the same bet: put these capabilities in defenders' hands before attackers have them. Anthropic has widened its Cyber Verification Program, which relaxes some blocking for vetted security professionals on current models, and released a security plugin for Claude Code so teams can scan pull requests before code ships. Claude Security, which we review, is its paid product for scanning whole codebases.
Much is left unsaid. The model is not named, and there is no word on whether or when it will be released. "Initial prompting" is not quantified, so the human share of the work is unclear. Beyond Chrome's 62 CVEs there is no total count, and other finds in OpenBSD, FreeBSD and web applications are mentioned without numbers. For everyone else, the practical lesson is that patch windows will shrink, so updating browsers, phones and kernels promptly matters more than it did a year ago.