What the public record establishes
Anthropic released the grouped account on October 27, describing research conducted over preceding months with an unnamed internal model. It reported demonstrations against Chrome, Safari, Android, Windows and Linux after initial human prompting. The publication date is not the date every underlying flaw was discovered or patched. [1]
The company described vendor coordination and fixes or mitigations for the reported issues. These are controlled research results, not evidence of victim intrusions or a public model release. Contemporary analysis noted differences between some component descriptions and vendor records, so this entry does not equate every narrative detail with a confirmed CVE description. [1][2]
Sources
- Discovering and exploiting vulnerabilities in critical, real-world software with Claude
Anthropic · Oct 27, 2026
- Anthropic's Five Exploit Chains: The Patch Checklist First, Then the AI Story
S5 Labs · Oct 28, 2026