An unreleased Anthropic research model discovered security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said1,2. The exploits were built in a lab setting after the model was prompted, not observed in any real-world attack.
Anthropic reported every flaw to the affected vendor before disclosure, and all vulnerabilities have been patched. Apple and Google have credited Anthropic and Claude for specific fixes, a detail that can be independently verified with those vendors.
What the model did
Anthropic's Frontier Red Team described five exploit chains in a research post. The company's central claim is not about any single bug but about the model's ability to find several separate flaws and combine them into a functioning exploit — work Anthropic says has until now required a few specialist human teams. One proof of concept opened the Calculator app on a stock Mac running Chrome within seconds of a page loading, with no additional user interaction.
Anthropic says the work needed only initial prompting and little human involvement, but the company does not break down what a person did at each step. It also does not name the model beyond calling it an unreleased, internal research model. For the Windows vulnerability — the one flaw with its own public record — the record names no finder at all.
ANALYSIS The capability claim rests entirely on Anthropic's own account. The patched bugs and vendor credits are checkable; the degree of autonomy the model exercised is not. Without a step-by-step breakdown of human involvement, outside observers cannot distinguish between a model that independently orchestrated full exploit chains and one that received meaningful human guidance at key junctures.
The disclosure arrives days after Google published cybersecurity benchmarks for Gemini 4 Carbon, which scored 88.2% on SEC-bench Pro for vulnerability finding and 54.8% on ExploitGym for exploitation[2].
ANALYSIS Anthropic's report does not cite comparable benchmarks, making direct performance comparisons between the two models impossible on the available evidence.
It also follows reporting that an Accenture employee's personal Claude agent operated on a Department of Defense network for approximately two months before detection[1].
ANALYSIS Taken together, the two episodes frame a widening gap between the offensive security capabilities AI labs are demonstrating and the controls governing how those models operate in practice.
The patches are already deployed.