{"schema_version":"0.9.0","id":"LR-2026-0265","record_version":2,"title":"Unreleased Anthropic research model chains zero-days into working exploits across Chrome, Safari, Android, Windows and Linux","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":48.3,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":4.8,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-28","extraction_run_id":null},"system":{"model_name":"Claude","model_version":null,"developer":"Anthropic","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"supervised-auto","guardrails_present":[],"deployment_context":"research","tier":"provider","lifecycle_stage":"pre_release","integration_type":null,"intended_use":"Security research: finding and chaining software vulnerabilities into proof-of-concept exploits","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-28","incident_class":"other","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Anthropic's Frontier Red Team reported that an unreleased internal model, prompted with little human involvement, found flaws in Chrome, Safari, Android, Windows and Linux and chained them into working proof-of-concept exploits in the lab.","tags":[],"date_detected":null,"near_miss":true,"root_cause":"unknown","root_cause_detail":"classified from described behaviour","failure_class_detail":null,"responsible_party":null,"adversarial_actor":"none","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"Coordinated disclosure with 90 days to patch and 45 more before details beyond a public advisory; fixes landed in Chrome 156, iOS/iPadOS 26.5.2, CVE-2026-33096 and CVE-2026-98432.","precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"negligible","severity_because":"negligible, because no effect beyond the system itself; nothing left changed: The exploits were lab proof-of-concepts never seen in a real attack, and every flaw was reported to the vendor and patched.","harm_class":["none_materialised"],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/10/anthropics-unreleased-ai-model-chains.html","publisher":"The Hacker News","date":"2026-10-28","type":"press","title":"Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.model_name":"C","system.tier":"D","system.lifecycle_stage":"C","system.intended_use":"C","system.developer":"C","system.autonomy_level":"D","system.deployment_context":"C","event.near_miss":"C","event.root_cause":"D","event.adversarial_actor":"C","event.remediation":"D","event.agent_involved":"C","event.summary":"C","event.incident_class":"D","event.detection_method":"D","event.date_disclosed":"A","event.trigger":"D","impact.harm_class":"D","impact.severity":"D","context.systemic_exposure":"D","context.denominator_available":"D","context.country":"D","event.root_cause_detail":"D","impact.severity_because":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"Google's own release notes credit \"Xinyang Ge of Anthropic, assisted by Claude\" for specific Chrome fixes, though not for all 62."}],"system.developer":[{"source_index":0,"quote":"An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report."}],"system.autonomy_level":[{"source_index":0,"quote":"Anthropic says the work needed only \"initial prompting\" and \"little human involvement,\" but it does not break down what a person did at each step, and it does not name the model beyond calling it an unreleased, internal research model."}],"system.deployment_context":[{"source_index":0,"quote":"Anthropic's Frontier Red Team described five chains in a research post."}],"system.lifecycle_stage":[{"source_index":0,"quote":"Anthropic says the work needed only \"initial prompting\" and \"little human involvement,\" but it does not break down what a person did at each step, and it does not name the model beyond calling it an unreleased, internal research model."}],"system.intended_use":[{"source_index":0,"quote":"An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report."}],"event.summary":[{"source_index":0,"quote":"An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report."}],"event.near_miss":[{"source_index":0,"quote":"The exploits were built in the lab after the model was prompted, not seen in any real attack, and Anthropic reported every flaw to the vendor first, so all of them are already patched."}],"event.adversarial_actor":[{"source_index":0,"quote":"The exploits were built in the lab after the model was prompted, not seen in any real attack, and Anthropic reported every flaw to the vendor first, so all of them are already patched."}],"event.agent_involved":[{"source_index":0,"quote":"Anthropic says the work needed only \"initial prompting\" and \"little human involvement,\" but it does not break down what a person did at each step, and it does not name the model beyond calling it an unreleased, internal research model."}],"event.incident_class":[{"source_index":0,"quote":"An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report."}],"event.detection_method":[{"source_index":0,"quote":"The exploits were built in the lab after the model was prompted, not seen in any real attack, and Anthropic reported every flaw to the vendor first, so all of them are already patched."}],"event.root_cause":[{"source_index":0,"quote":"Anthropic says the work needed only \"initial prompting\" and \"little human involvement,\" but it does not break down what a person did at each step, and it does not name the model beyond calling it an unreleased, internal research model."}],"impact.severity_because":[{"source_index":0,"quote":"The exploits were built in the lab after the model was prompted, not seen in any real attack, and Anthropic reported every flaw to the vendor first, so all of them are already patched."}],"impact.harm_class":[{"source_index":0,"quote":"The exploits were built in the lab after the model was prompted, not seen in any real attack, and Anthropic reported every flaw to the vendor first, so all of them are already patched."}],"context.systemic_exposure":[{"source_index":0,"quote":"Anthropic says the work needed only \"initial prompting\" and \"little human involvement,\" but it does not break down what a person did at each step, and it does not name the model beyond calling it an unreleased, internal research model."}],"event.remediation":[{"source_index":0,"quote":"It says it reported each flaw under a coordinated disclosure policy that gives developers 90 days to patch and 45 more before it discusses details beyond a public advisory, and it points security teams to its expanded Cyber Verification Program, which gives vetted professionals access to Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1."}],"impact.severity":[{"source_index":0,"quote":"The exploits were built in the lab after the model was prompted, not seen in any real attack, and Anthropic reported every flaw to the vendor first, so all of them are already patched."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-28"}]},"notes_on_gaps":"Single source (press). No source states who first noticed the behaviour, so detection_method is unknown and story.caught is null; the vendor notification is disclosure, not detection. No source names a cause, so trigger and root_cause are unknown. incident_class is 'other': the model found and chained real vulnerabilities in the lab, which is neither a false output, a refused action, nor an attacker-driven breach; no value's test is met. failure_class is null because the model was doing the task it was prompted to do, with no agent-mechanism failure stated. autonomy_level is classified supervised-auto from 'little human involvement' with a person at initial prompting; the source does not break down human steps. model_name 'Claude' rests only on vendor release-note credits, not on the model being named. No loss figure, record count, third-party count, duration or containment time is stated. severity negligible because the exploits were lab-only, never seen in a real attack, and all flaws were patched. event.trigger: unknown was classified, not stated; a trigger is never inferred, so it is unknown. system.tier: provider by rule (deployment_context research). [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-28] system.autonomy_level: a source states the agent acted while a person watched or could stop it. event.remediation: classified from described behaviour. event.incident_class: classified from described behaviour. event.detection_method: no source says who first noticed. event.trigger: no source states a cause. impact.harm_class: classified from described behaviour. context.systemic_exposure: classified from described behaviour. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location."},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":false,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Anthropic's Frontier Red Team prompted an unreleased internal model to hunt for security flaws in Chrome, Safari, Android, Windows and Linux and chain them into working exploits, in the lab rather than against real targets.","quote":"Anthropic's Frontier Red Team described five chains in a research post.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The model produced working proof-of-concept exploits, including a Chrome chain escaping the browser sandbox and a Linux chain giving root over the network, capabilities the company says were previously the work of specialist teams.","quote":"The strongest claim is not any single bug, but that one model found several separate flaws and combined them into a working exploit, something the company says has until now been the work of a few specialist teams.","source_index":0,"grade":"C"},{"step":"reached","text":"The chains reached Chrome on macOS, Safari on iOS and iPadOS, a locked Android phone over USB, Windows servers answering HTTP/3, and Linux servers running a multipath TCP listener. No real attack occurred.","quote":"An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report.","source_index":0,"grade":"C"},{"step":"done","text":"Anthropic reported each flaw under a coordinated disclosure policy giving developers 90 days to patch and 45 more before details beyond a public advisory; fixes landed in Chrome 156, iOS/iPadOS 26.5.2, CVE-2026-33096 and CVE-2026-98432.","quote":"It says it reported each flaw under a coordinated disclosure policy that gives developers 90 days to patch and 45 more before it discusses details beyond a public advisory, and it points security teams to its expanded Cyber Verification Program, which gives vetted professionals access to Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-28","source_urls":["https://thehackernews.com/2026/10/anthropics-unreleased-ai-model-chains.html"]}}