Anthropic's Frontier Red Team (Oct 27 post) says an unreleased research model found and exploited critical flaws in lab tests: a one-click Chrome sandbox escape, a one-click Safari same-origin bypass, a Pixel 9 lock screen bypass, a zero-click Linux kernel MPTCP root RCE, and a remote Windows kernel QUIC crash (denial of service, not code execution). All were reported to vendors under coordinated disclosure; Chrome's Oct 27 update fixed 52 flaws, many credited to Claude.
What to do: Oct 31: BleepingComputer details the Linux item: CVE-2026-98432, unauthenticated remote root on servers with Multipath TCP listeners; Anthropic researchers built the exploit. No in-the-wild use reported. Patch kernels with MPTCP enabled.
🛑 An unreleased Anthropic AI model chained security flaws into working exploits across Chrome, Safari, Android, Windows, and Linux. One Chrome exploit escaped the browser sandbox and launched Calculator on a Mac just by loading a page. Details on five chaine
‼️ Claude AI Builds One-Click Chrome and 0-Click Linux Exploit Chains, Bypasses Android Lock Screen Details: https://cybersecuritynews.com/claude-ai-builds-exploit/ Anthropic's Frontier Red Team says an unreleased Claude research model wrote working exploit
🚨 Google patches 52 Chrome security flaws, including 4 CRITICAL bugs. But here's the bigger story: → Claude AI discovered dozens of Chrome vulnerabilities. → Built a working, multi-stage exploit chain. → Escaped Chrome's browser sandbox to execute code. Det
Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners.
Why this score
Plan rubric with caps (verified sweep, Oct 29)