An unreleased AI model from Anthropic has identified security vulnerabilities in popular platforms including Chrome, Safari, Android, Windows, and Linux, and successfully created proof-of-concept exploits, according to the company’s recent report.
These exploits were developed in a controlled environment after the model received prompts and were not observed in any real-world attacks. Anthropic ensured that all flaws were reported to the respective vendors prior to public disclosure, meaning they have all been patched. One notable proof of concept allowed the Calculator application to launch on a standard Mac using Chrome mere seconds after a webpage was accessed, without any additional clicks.
Details from Anthropic’s Frontier Red Team
In a research post, Anthropic’s Frontier Red Team detailed five exploit chains. The most significant finding is not a single bug, but rather that the AI model was able to discover multiple flaws independently and link them into a functional exploit. This capability, according to Anthropic, has traditionally been the domain of specialized teams.
The effectiveness of the patches and the recognition by Apple and Google of Anthropic’s contributions, along with its Claude model, can be verified with the vendors.
Unverifiable Aspects of the Findings
However, the extent of the model’s independent work in creating these chains cannot be independently verified. Anthropic claims that the process required only minimal human intervention and initial prompts, yet it does not specify the exact involvement of individuals at each stage, nor does it disclose the model’s name beyond referring to it as an internal research tool.
Exploit Chains Summary
Below is a summary of the five exploit chains identified:
- Chrome: Executes code outside the browser’s sandbox upon loading a webpage. Condition: One click or page load on a standard Chrome installation on macOS. Fix: Chrome 156, October 20.
- Safari: Allows any website to access data from other sites a user is logged into. Condition: Visiting a malicious page. Fix: iOS and iPadOS 26.5.2, June 29.
- Android: Extracts photos and data from a locked, stolen phone. Condition: Physical access to the device via USB. Fix: Confirmed by Anthropic; no public record available.
- Windows: Conducts a denial-of-service attack by crashing a server and keeping it down. Condition: The server must respond to HTTP/3 requests. Fix: CVE-2026-33096, patched April 2026.
- Linux: Executes commands as root over a network without requiring user login. Condition: The server must have a multipath TCP listener. Fix: CVE-2026-98432, patched October 15.
In-Depth Chain Analysis
In the Chrome exploit chain, the model exploited four distinct vulnerabilities sequentially. The first flaw corrupted memory in V8, Chrome’s JavaScript engine, while the second allowed it to escape V8’s memory sandbox. A race condition in CacheStorage then enabled access to restricted memory, leading to a use-after-free bug in FedCM that allowed the execution of code outside the sandbox.
Anthropic reported 62 vulnerabilities to Google, all classified as critical or high, with 13 involving sandbox escapes, which have been addressed in Chrome 156. Google’s release notes specifically thank “Xinyang Ge of Anthropic, assisted by Claude” for certain fixes.
The Safari exploit operates differently; it does not run any code but instead obtains full read and write access to the browser’s memory, allowing a malicious site to read users’ data and interact with other sites on their behalf. Apple has addressed the core flaw in iOS and iPadOS 26.5.2, crediting “Milad Nasr and Nicholas Carlini with Claude, Anthropic” for their contributions.
The Windows vulnerability, linked to a denial-of-service attack, has a clearer paper trail, yet its specific details remain somewhat ambiguous. Anthropic cites an out-of-bounds read in the Windows kernel’s QUIC handling, but the corresponding CVE record attributes it to HTTP.sys, Windows’ built-in web request handler.
For the Linux exploit, which poses a significant risk, it allows command execution as root over the network without any login required. Anthropic states it took approximately 48 minutes to leak a kernel address and an additional five minutes to establish a root shell. This exploit connects to CVE-2026-98432, a severe kernel vulnerability that was addressed recently.
Anthropic’s Intentions and Future Directions
Anthropic positions this research as a resource for defenders, highlighting its commitment to responsible disclosure. The company reported each flaw under a coordinated disclosure policy, providing developers with 90 days to implement patches before discussing details publicly. They also direct security teams to their expanded Cyber Verification Program, which grants vetted professionals access to the latest AI models.
In Anthropic’s own words, the purpose of sharing this information is to demonstrate that models can autonomously identify vulnerabilities with minimal human assistance and validate them through the execution of working exploits.
