Anthropic: Unreleased Claude Model Built Five Exploit Chains, Including a Pixel 9 Lock Screen Bypass

On October 27, Anthropic's Frontier Red Team published a write-up of research in which an unreleased internal Claude research model found vulnerabilities and combined them into five working attack chains. The targets were Chrome, Safari, Android on the Pixel 9, Windows and Linux. According to Anthropic, vendors have patched the flaws described.

Five targets, five chains

Anthropic says the model worked after initial prompting and built full chains from source code and reverse engineering, rather than isolated bugs. In Chrome on macOS, the chain started with heap corruption in the V8 engine, moved through a V8 sandbox escape and a race condition in CacheStorage, and ended with a use-after-free in FedCM. In testing, Calculator launched within seconds of the page loading.

In Safari, the chain included a bug in JavaScriptCore, a Gigacage bypass and a flaw in the IPC mechanism of the WebContent sandbox, and it finished by disabling the same-origin policy. Anthropic describes it as a data-only attack that does not execute arbitrary code. Apple fixed the vulnerability, and according to Anthropic some of Safari's weaknesses are intended behaviors that become dangerous only when combined.

The locked Pixel 9

The Android case is the most tangible for users. The model analyzed open-source Android code, decompiled Google Play services binaries and tested its results on a physical Pixel 9. It chained three of the vulnerabilities it found and got past successive layers of protection: the block on USB data transfer on a locked device, the authorization check in the device-to-device transfer protocol, and the six-digit code verification, behaving as if the user had tapped "Allow."

A fallback mechanism then sent raw bytes over USB and sidestepped the hardcoded check on file contents. The result: photos and personal data could be extracted from a stolen, locked phone. The attack requires physical access to the device. Anthropic says Google fixed the issue, but according to eSecurity Planet, Anthropic did not identify the patched software build.

Windows and Linux

On Windows, the flaw is an out-of-bounds read in the kernel's QUIC implementation, reachable over HTTP/3. A few packets are enough to crash and restart a machine. The bug was found through binary analysis in Ghidra, and Anthropic estimates that millions of servers are exposed. According to the authors, the main difficulty was simply finding the flaw.

On Linux, the model exploited a race condition leading to a use-after-free in the multipath TCP stack. The first stage defeats KASLR by leaking an address, and the second overwrites a callback pointer and runs commands with root privileges. A lost race only fails the handshake without crashing the system, so an attacker can retry many times. The fix landed in the kernel and stable branches, but eSecurity Planet notes that an Ubuntu advisory from October 28 still listed some releases as being fixed.

Caveats and next steps

These are lab results described by Anthropic itself, from a model that is not publicly available. Anthropic cites a disclosure policy of 90 days to patch plus a further 45 days before additional details are discussed. The CVEs mentioned relate to the examples described, not to all of the findings.

Our advice to defenders remains the same: scanning your own code is more important than ever. - the Frontier Red Team, Anthropic

For Polish security teams, the practical takeaway is simple: check the patch level of browsers (Chrome 156 and later), Linux kernels and Windows servers with HTTP/3 enabled. For Pixel 9 owners, it is one more argument for installing updates promptly and protecting the device against theft, since the attack described requires physical access.