Anthropic Internal Model Autonomously Chains 62 Chrome CVEs into 5 Attack Chains on October 27

On October 27, 2026, Anthropic's Frontier Red Team released a research report: an unreleased internal model, with almost no human intervention, autonomously discovered and chained security vulnerabilities in Chrome, Safari, Android, Windows, and Linux, forming five executable attack chains. The Chrome chain achieved zero-click remote code execution based on 62 CVEs (including 13 sandbox escapes).

Factual Reconstruction

The report shows that after an initial prompt, the model wrote a complete exploit chain for Chrome: it first discovered a heap memory corruption vulnerability in the V8 JavaScript engine, then broke out of the V8 memory region sandbox and defeated ASLR, then used a CacheStorage race condition to read the browser process memory layout, and finally achieved arbitrary code execution outside the sandbox through a FedCM use-after-free vulnerability. The 62 CVEs have been assigned and patched in Chrome 156; all are critical or high severity, and 13 are sandbox escapes.

The Safari chain was also autonomously constructed by the model, achieving bypass of the same-origin policy to read data such as history and cookies. The model discovered a use-after-free vulnerability in JavaScriptCore, broke through Gigacage isolation, then used the sandbox IPC mechanism to read disk data, and finally modified security flags to disable the same-origin policy. Apple confirmed and quickly fixed it on the day of submission.

The Android chain achieved lock-screen bypass on a locked phone. The model combined source code analysis, reverse engineering, and real-device testing to bypass USB transfer restrictions, authorization checks, six-digit verification-code checks, and a hard-coded check on file-content transfer, extracting information such as photos.

Mechanism Breakdown

The model's attack-chain construction process shows multi-step autonomous chaining capability: starting from a single memory corruption vulnerability, it gradually combined sandbox escapes, address layout randomization bypasses, and inter-process communication flaws. In the Chrome chain, after compromising the renderer process, it further broke through the browser process sandbox, reflecting step-by-step breakthrough of multiple layers of protection. The Safari chain used a pure data-only attack path, did not rely on arbitrary code execution, and modified security flags only through memory reads and writes.

These chains cover open-source and proprietary software and involve key components such as browser engines, sandbox mechanisms, and system IPC. Under prompt guidance, the model completed the entire process from vulnerability discovery to full exploit-chain construction, without relying on continuous human intervention.

Industry Impact

All vulnerabilities have been reported to vendors and patched under the coordinated vulnerability disclosure process; Chrome was given a 90-day patch period and an additional 45-day discussion buffer. For the first time, the report shows from a defensive perspective that exploit-chain composition, historically requiring top red-team experts, can now be completed automatically by frontier AI.

This means that in security research, AI can accelerate the discovery and chaining of vulnerabilities across multiple platforms and components, affecting the vulnerability management pace of browser and operating system vendors. The Android chain involved real-device testing, showing AI's application potential in hybrid analysis (source code, reverse engineering, and binaries).

Strategic Judgment

[Analysis] The report measures the lower bound of AI in attack-chain construction; together with the upper bound of AI compliance measured by other research, this points to the boundary of AI's impact on infrastructure. The gap between vendor patching speed and AI's autonomous discovery speed may change future vulnerability disclosure and patch prioritization, but the specific impact still needs to be observed in subsequent real-world cases.

[Analysis] Historically, exploit chains were mostly an expert skill exclusive to human specialists; now AI can quickly generate them after a prompt, which may lower the attack threshold. However, the report emphasizes that all cases have been patched and does not show exploitation risk from unpatched vulnerabilities.