Anthropic has published an account of vulnerability research using Claude across widely used browsers and operating systems. The October 27 report describes work with an unreleased internal research model and five attack chains. The findings are company-reported results; Franklin did not reproduce the exploits.
What the research covered
The report discusses Chrome, Safari, Android, Windows and Linux. It describes multi-step chains rather than only isolated flaws, with impacts ranging from access to personal information to denial of service and remote code execution.
Anthropic says it reported the vulnerabilities through coordinated disclosure. That matters because a useful account of offensive capability also needs to explain how affected vendors received the findings and what users can do about the exposure.
Model capability and product availability are different
The model used for this work was an internal research system. The report should therefore not be read as evidence that every publicly available Claude product can reproduce the same results or that the demonstrated workflows are generally available.
The examples also involve a research process, initial prompting and supporting tools. They are evidence about what the described system achieved in those conditions, not a universal success rate across software or a new independent comparison with human security researchers.
What defenders can take from the report
Anthropic links vendor fixes and public advisories for the disclosed issues. For ordinary users and software operators, following the applicable vendor update guidance is more actionable than attempting to recreate an exploit chain.
For security teams, the broader question is whether testing covers how several weaknesses can combine. Review exposed services, patch status and response ownership as a connected system. The report supports taking AI-assisted discovery seriously while keeping the scope of the demonstrated evidence clear. It does not establish that a model can find every vulnerability or that patching the listed issues eliminates unrelated risks.