The Circuitry
THE CIRCUITRYYour one-stop source for all tech news
HOMETODAYNEWSFEEDEVENTS
BOOKMARKS
SOONSTARTING SOONGitHub Universe 2026 KeynoteIN 4HOpen coverage →
RSS
© 2026 The Circuitry
About UsSourcesContactCorrectionsPrivacy
  • Today
  • Feed
  • Events
  • Saved
  • AAPL
  • MSFT
  • GOOGL
  • META
  • NVDA
  • TSLA
  • AMZN
  • INTC
  • SONY
  • TTWO
  • COIN
  • BTC
  • ETH
  • SOL
  • AAPL
  • MSFT
  • GOOGL
  • META
  • NVDA
  • TSLA
  • AMZN
  • INTC
  • SONY
  • TTWO
  • COIN
  • BTC
  • ETH
  • SOL

Feed

Ad

Verified tech news, cross-checked.

  • GameSir Reveals Sunset Boulevard and Ocean Breeze G7 Pro ControllersGaming
  • HUNGER Extraction RPG Test Draws 16,000 PlayersGaming
  • OpenAI Reportedly Plans to Buy Google's AI Chips, The Information SaysTech
  • GSA Cuts Claude Pricing 40% for Governments in OneGov DealTech
  • SAP and NTT Announce Intent to Cooperate on Sovereign Cloud and Business AITech
  • Microsoft Flags Edge Type-Confusion Flaw CVE-2026-62765 (CVSS 7.5)Tech
  • Guidewire to Acquire hyperexponential for $1.7 Billion in CashTech
  • Apple Puts M6 in 14-Inch MacBook Pro, From $1,999Tech
Scroll for more
Verification
VERIFIEDConfidence: HIGH
Source identified
Claims cross-referenced
No discrepancies found
Sourcing
1source

via The Hacker News

The Hacker News · track record
2Stories
100%Verified
230d
All sources →
From The CircuitryWhy The Circuitry

Verified tech news, cross-checked.

Every story is checked against independent sources before it posts — no rumors dressed up as fact.

How we verify →
Home/Tech/Anthropic Says Unreleased Model Chained Flaws Into Five Working Exploits
VERIFIEDBy Xavier Rivera·Wednesday, October 28, 2026 at 6:23 AM AST·1.5 min read

Anthropic Says Unreleased Model Chained Flaws Into Five Working Exploits

Anthropic's Frontier Red Team says an unreleased internal research model built working proof-of-concept exploit chains for Chrome, Safari, Android, Windows and Linux, and that each has been reported and fixed. Vendor records confirm Chrome 156 fixes credited to Anthropic with Claude, an Apple WebKit fix credited the same way, and Microsoft's April 14 fix for CVE-2026-33096. Anthropic has not named the model, and some links between the chains and public CVEs rest on its own post.

Source:The Hacker News
Post
Anthropic Says Unreleased Model Chained Flaws Into Five Working Exploits
From The CircuitryWhy The Circuitry

Verified tech news, cross-checked.

Every story is checked against independent sources before it posts — no rumors dressed up as fact.

How we verify →
TL;DRAI · 60 sec read

Anthropic says an unreleased, internal research model chained flaws into five proof-of-concept exploits for Chrome, Safari, Android, Windows and Linux, and that each has been fixed.

Anthropic's Frontier Red Team said on Oct. 27 that an unreleased, internal research model found vulnerabilities in widely used browsers and operating systems and chained them into five proof-of-concept attacks. It did not name the model. Anthropic says it reported each flaw to the vendor first and that each chain has been fixed.

The chains cover a one-click Chrome attack that escapes the browser sandbox (tested on stock Chrome on macOS), a Safari attack that bypasses the same-origin policy, an Android attack that pulls data from a stolen, locked Pixel 9 over USB, a remote Windows crash through HTTP/3, and a zero-click Linux remote-root attack on servers with a multipath TCP listener. Anthropic says the Chrome fixes are in Chrome 156; Google's release notes credit Anthropic's Xinyang Ge, assisted by Claude, on several fixes in the Oct. 20 and Oct. 27 builds.

Microsoft's advisory for CVE-2026-33096, an HTTP.sys denial-of-service bug fixed April 14, credits Anthropic and Calif.io with Claude and says it is not known to be exploited. Apple's iOS 26.5.2 notes (June 29) credit Anthropic researchers with Claude for a WebKit use-after-free, CVE-2026-43715, though Apple does not link it to this chain. Anthropic ties the Linux chain to CVE-2026-98432; the public kernel record describes an IPv4 TCP bug and does not mention multipath TCP. Anthropic gave no public details for the Android fix.
From The CircuitryWhy The Circuitry

Verified tech news, cross-checked.

Every story is checked against independent sources before it posts — no rumors dressed up as fact.

How we verify →
The capability claims, including that the model needed only initial prompting, come from Anthropic's own account.
Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Morning Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning.

Two minutes, free forever. What's in The Brief →

Reader-supported
DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →
HELP US IMPROVE
From The Circuitry

See what’s happening right now

The Feed runs all day — short, verified briefs the moment they break.

Open the Feed →
From The Circuitry

Follow @thecircuitry_

Every story we publish, as it happens. No noise between.

Follow on X ↗On Bluesky ↗

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee
More fromThe Hacker News
  • OpenAI cuts live internet from frontier AI training after DNS slip, red-team VM escapes

    3d
More inTech
  • Microsoft Flags Edge Type-Confusion Flaw CVE-2026-62765 (CVSS 7.5)

    Tech · 1h
  • Guidewire to Acquire hyperexponential for $1.7 Billion in Cash

    Tech · 1h
  • Apple Puts M6 in 14-Inch MacBook Pro, From $1,999

    Tech · 7h
SupportThe Work

The Circuitry is reader-supported. If you find the daily brief useful, you can buy me a coffee to keep it going.

Buy a coffee →
From The CircuitryWhy The Circuitry

Verified tech news, cross-checked.

Every story is checked against independent sources before it posts — no rumors dressed up as fact.

How we verify →

MORE IN THIS BEAT

All Tech →
  • Tech·Oct 28

    GameSir Reveals Sunset Boulevard and Ocean Breeze G7 Pro Controllers

    GameSir has announced Sunset Boulevard and Ocean Breeze editions of its G7 Pro controller, with tropical, Miami-sunset-inspired designs, and opened pre-orders. GameSir says they are designed for Xbox and keep TMR sticks, 1000Hz polling, dual-mode triggers and four remappable buttons. Insider Gaming reports a £99.99 price and a November release; GameSir has not given a visible price or exact date in its announcement.

  • Tech·Oct 28

    HUNGER Extraction RPG Test Draws 16,000 Players

    HUNGER extraction RPG's closed test peaked at 16,000 players and prompted GOOD FUN Corporation to outline targeted fixes. The results show strong player retention during a wipe-enabled test window.

  • Tech·Oct 28

    OpenAI Reportedly Plans to Buy Google's AI Chips, The Information Says

    OpenAI plans to buy Google's TPU AI chips, The Information reported Tuesday citing a person familiar; no terms disclosed, OpenAI declined to comment.

  • Tech·Oct 28

    GSA Cuts Claude Pricing 40% for Governments in OneGov Deal

    GSA says its expanded OneGov deal with Anthropic gives government buyers 40% off token-based Claude usage with no minimum order. Anthropic estimates the discounts will save the government $1 billion.

  • Tech·Oct 28

    SAP and NTT Announce Intent to Cooperate on Sovereign Cloud and Business AI

    SAP and NTT said Oct. 28 they intend to cooperate on SAP Sovereign Cloud and SAP Business AI. As a first step, they plan to combine SAP Sovereign Cloud On-Site with NTT-managed infrastructure and operations for customers in unnamed "key markets." The companies did not announce financial terms, named markets or a timeline.