Anthropic's Unreleased Model Wrote Five Working Exploit Chains. Defenders Get Three Access Tiers, and the Top One Is Vetted With the US Government.
Anthropic's Frontier Red Team published on October 27 that an unnamed internal research model, after initial prompting, produced five working exploit chains, including a one-click Chrome remote code execution path spanning 62 patched CVEs with 13 sandbox escapes, and a zero-click Linux root path, CVE-2026-98432. The model is not released, so nobody outside can retest. Anthropic's Cyber Verification Program, expanded October 6, now has Defense, Red Team, and Specialized tiers; the top tier is reviewed with the US government and absorbs Glasswing partners. General-availability Claude models keep their cyber blocks. We read the research post and the program pages.
By T.W. Ghost
Anthropic's Frontier Red Team published a research post today, October 27, 2026, describing five working exploit chains built by an unnamed internal research model "after initial prompting." The largest is a one-click Chrome remote code execution chain on macOS covering 62 CVEs patched as of Chrome 156, all rated high or critical, including 13 sandbox escapes and 21 renderer compromises. The others: a Safari same-origin bypass limited to data, extraction of data from a locked Pixel 9 over USB, a remote crash of Windows HTTP/3 (CVE-2026-33096), and a zero-click Linux root remote code execution through multipath TCP (CVE-2026-98432).
The model that did this is not for sale. It is unreleased and unnamed, which means no one outside Anthropic can reproduce the chains, and "after initial prompting" leaves the human share of the work undefined. What is available is the access program that sits in front of Anthropic's shipping models for this kind of work. The Cyber Verification Program, expanded on October 6, now has three tiers, and the top one is reviewed with the US government. We read the research post, the program announcement, and the support article. We summarize only what Anthropic published and reproduce no technique. Here is what held up.
The Five Chains, as Anthropic Describes Them
| Chain | Anthropic's summary |
|---|---|
| Chrome on macOS | One-click remote code execution; 62 CVEs patched as of Chrome 156, all high or critical; 13 sandbox escapes; 21 renderer compromises |
| Safari | Same-origin bypass, data only |
| Pixel 9 | Data extraction from a locked device over USB |
| Windows | HTTP/3 remote crash, CVE-2026-33096 |
| Linux | Zero-click root remote code execution via multipath TCP, CVE-2026-98432 |
The CVE counts are Anthropic's coordinated-disclosure tally. They come from the lab's own report of what it disclosed and what was patched, not from an independent count. We print them as such.
The model is the thing you cannot evaluate. No name, no release, no third-party run. The claim is credible in the specific way a disclosed-and-patched CVE list is credible, and unverifiable in the specific way an unreleased model is.
"After initial prompting" is doing work. It is not "with no human input." The post does not say how much steering followed the initial prompt.
The Three Tiers
| Cyber Verification Program (expanded October 6) | Who | Review |
|---|---|---|
| Defense | Enroll while a higher tier is pending | Standard |
| Red Team | Organizations only | Weeks to review |
| Specialized | Reviewed with the US government | Glasswing members transition in; no re-approval for current models |
| Models covered | Opus 5.5, Sonnet 5.5, Mythos 5.1 |
Anthropic's own evaluation of the gates, CyScenarioBench: with no verification, every scenario is blocked at the first prompt; at the Defense tier, 46 of 50 are blocked; at Red Team, 34 of 50 complete with zero blocks. Those are vendor numbers from Anthropic's eval. A separate vendor figure: Glasswing partners reported at least 129,000 verified vulnerabilities between April and July 2026, from a survey subset.
The general-availability models stay locked down. The research model wrote the chains; the shipping models, without a tier, block the work at the first prompt by Anthropic's own measurement. The program is the only path, and the top of it runs through a government review.
This is the week's pattern. Google gated Gemini 4 Carbon to Fairwind cyber defenders the next day; OpenAI shipped GPT-6.1 Terra with a Critical cyber rating in the product post. Three labs, three gates, in eight days.
Verified vs Unconfirmed: The Scorecard
| Claim | Verdict |
|---|---|
| Research post Oct 27, 2026; five chains described | Verified (Anthropic research post) |
| Chrome 62 CVEs as of Chrome 156, all high or critical; 13 sandbox escapes; 21 renderer | Verified as Anthropic's report |
| CVE-2026-33096 (Windows); CVE-2026-98432 (Linux) | Verified as Anthropic's report |
| Model unnamed and unreleased | Verified (post) |
| CVP tiers Defense, Red Team, Specialized; Opus 5.5, Sonnet 5.5, Mythos 5.1 covered | Verified (CVP announcement, Oct 6) |
| Red Team organizations only, weeks to review; Specialized reviewed with US government; Glasswing transition | Verified (CVP announcement) |
| CyScenarioBench block counts | Vendor (Anthropic eval) |
| Glasswing 129,000 verified vulnerabilities Apr to Jul 2026 | Vendor (survey subset) |
| Independent reproduction of any chain | Not possible (model unreleased) |
What To Do
Cite the research post for the chains and the program page for the tiers, and do not describe the research model as something you can get.
If you do defensive work on Claude, the Defense tier is the enrollment path while a Red Team or Specialized review is pending; the review clock is weeks.
The frontier is elsewhere: the model that matters here is the one nobody can call. Our model comparison has the current standings on the ones you can, and Anthropic's S-1 risk factors, filed the day before, describe what one of its models did with real access by accident rather than by assignment.
Sources
- Anthropic: discovering vulnerabilities with Claude
- Anthropic: Cyber Verification Program
- Claude support: Cyber Verification Program
*Not sure which lab's cyber gate your security team can actually get through? Take the free 2-minute quiz and get matched. Then read about the gate Google put on its new number-one model: Gemini 4 Carbon.*