Anthropic Says Its Unreleased Model's Chrome Findings Got 62 CVEs. A Day Later, Google Pitched Gemini 4 Carbon on Patches, Citing a More Than 10x Win Over an Unnamed Lab's Model.

On Tuesday, October 27, 2026, Anthropic's Frontier Red Team published five attack chains built by "an unreleased, internal research model." The targets were Chrome, Safari, a Google Pixel 9, Windows and Linux. The Chrome line is the one that stuck with us: "62 CVEs have been assigned and patched as of Chrome 156, with all of them rated critical or high severity."

On Wednesday, Google announced Gemini 4 Carbon, which it calls "our strongest model with state-of-the-art cybersecurity and long horizon capabilities." One of its headline claims comes from the same browser team. Google says the Chrome team reported that Carbon did more than 10 times better than another lab's large frontier model at producing security patches. Google did not name the lab.

Put the two posts side by side and you get the state of AI security in late October. One lab is showing how much a model can break. The next day, another is selling a model on how well it fixes. Neither model is something most people can use today.

What Anthropic's Model Did

Anthropic says it used the model "over the past few months" and reported every bug under its coordinated disclosure policy, which gives vendors 90 days to patch and a further 45 days before Anthropic discusses details beyond the public advisory. It does not name the model or give a total bug count.

The Chrome chain on macOS runs from V8 heap corruption through a V8 sandbox escape, a CacheStorage race and a FedCM use-after-free. Its proof of concept launches Calculator from a default-configuration Chrome within seconds of a page loading. Among the 62 Chrome CVEs, Anthropic counts 13 sandbox escapes and 21 renderer-compromise bugs.

The Safari chain bypasses the same-origin policy, which can expose history, cookies and session data. Apple acknowledged the report the same day it was submitted and shipped a fix. The Pixel 9 chain gets photos and personal data off a locked phone; Anthropic says Google has addressed it. The Windows bug is a remote crash in the kernel's QUIC code, reachable over HTTP/3, and Anthropic says the model found it "through binary analysis." It is CVE-2026-33096, and Anthropic estimates "several million" such servers are listening on the internet.

To us, the Linux finding is the most serious of the five: a zero-click remote root exploit through a multipath TCP listener, fixed as CVE-2026-98432 and backported to maintained stable branches. In Anthropic's proof of concept, it takes 48 minutes to leak a kernel pointer and another five minutes to reach a shell.

What Google Says Carbon Does

Google's cyber numbers for Carbon are all self-reported and, by its own note, "evaluated without guardrails": 88.2 percent on SEC-bench Pro for finding vulnerabilities, 54.8 percent on ExploitGym for exploitation, and 71.0 percent on Collinear's CWE-bench for patching. Google calls the first two state of the art. It also says Carbon has "more than 2x uplift in success rate for generating secure code over Argon" on internal benchmarks, and that Wiz sees it leading on web penetration testing benchmarks.

One number is not Google's. On the Artificial Analysis Intelligence Index v5.0, Gemini 4 Carbon (High) sits first at 59, one point ahead of Claude Opus 5.5 (Max) at 58. That is a lead, not a gap.

Then there is access. Starting this week, Google says, Carbon goes to "a subset of cyber defenders," then to more trusted partners through the Fairwind Program. Google says it is taking part in the U.S. government's voluntary process for pre-release model testing. Developers, businesses and consumers get it "as soon as possible," with no date. Pricing is set anyway: an introductory $2 per million input tokens and $10 per million output tokens, the same as Argon, then $4 and $20.

The Chrome Patch Number Keeps Growing

Google has leaned on Chrome's security team for this kind of claim before. When Google opened Fairwind in early September with Gemini 3.8 Flash Cyber, Help Net Security reported that Chrome Security said that model "produced 2.6 times more correct patches than the best commercial models." Eight weeks later the multiple is more than 10, against one unnamed rival.

Those two numbers do not measure the same thing, and Google has not published how either was measured. We would not read them as a trend line. We would read them as a sales message that has stayed the same while the model under it changed.

Carbon is also arriving fast. Google opened Argon to paying developers on October 13, 13 days after it first went to Fairwind members on September 30. Carbon landed 15 days after that. Constellation Research's Larry Dignan wrote that Google is speeding up its frontier release cadence.

Our Take

The useful sentence in Anthropic's post is not the 62. It is this one: "Fixing the existing backlog only solves half the problem; the other half is cutting the rate at which new vulnerabilities enter the codebase." Finding bugs is no longer the scarce step. One unreleased model produced 62 critical or high Chrome CVEs, and the vendor had to absorb all of them. The bottleneck is the patch, the review and the release.

Google clearly sees the same thing, which is why Carbon's pitch leans on patching and secure code rather than only on exploits. That is the right product to build. But the evidence is thin where it matters most. A more than 10x claim against a nameless model, from Google's own browser team, with no method, is marketing until Google publishes the test.

Both labs are now running the same play: gate the strongest cyber model, show results, sell the access later. We think that is defensible for exploit capability. We are less sure it is defensible for patching, where the people who most need help are small maintainers, not the vetted partners at the front of the queue. Anthropic at least points qualifying defenders to its Cyber Verification Program and a Claude Code security plugin. Google has a price for Carbon and no date.

Three things to watch over the next 60 days. First, whether Google gives Carbon a general availability date or ends Argon's introductory pricing first. Second, whether Google publishes the Chrome patch evaluation or names the other lab. Third, whether Anthropic names the research model behind the five chains, or publishes the full list of 62 Chrome CVE IDs so outsiders can check the count.

Sources: Anthropic Frontier Red Team (October 27), Google (October 28), Google on Argon for developers, Artificial Analysis, 9to5Google, Constellation Research, explainx.ai, Help Net Security.