Anthropic says an unreleased artificial intelligence model discovered security vulnerabilities across major platforms, including Google Chrome, Apple Safari, Android, Microsoft Windows, and Linux. According to the company, the model combined multiple flaws into working proof-of-concept exploits, demonstrating how AI could assist with complex vulnerability research.
Anthropic reported the vulnerabilities to the relevant vendors before publishing its findings. The company says the demonstrations were conducted in controlled laboratory environments and were not observed in real-world attacks. The flaws described in the report have been patched.
One demonstration reportedly enabled a proof-of-concept exploit to launch the Calculator application on a standard Mac running Chrome within seconds of a webpage loading, without requiring further interaction.
Five Exploit Chains Across Major Platforms
Anthropic's Frontier Red Team detailed five exploit chains in a research report. The findings illustrate how individual vulnerabilities can be combined to bypass security protections and achieve outcomes that a single flaw might not permit.
However, the extent of the model's independent contribution remains difficult to assess. Anthropic says the research required initial prompting and little human involvement, but it has not published a detailed breakdown of the work performed by the model versus human researchers. The company also has not publicly identified the model beyond describing it as an unreleased internal research system.
The five demonstrations targeted different components and required different conditions.
PlatformReported impactRequired conditionsGoogle ChromeCode execution outside the browser sandboxA malicious webpage and the exploit conditions described by AnthropicApple SafariAccess to data across websitesVisiting a malicious webpageAndroidExtracting photos and other data from a locked devicePhysical access and a USB connectionWindowsRepeatedly crashing a server remotelyA server handling HTTP/3 requestsLinuxExecuting commands with root privileges remotelyA server running a multipath TCP listener
Chrome Exploit Chain Combined Four Vulnerabilities
The Chrome demonstration reportedly combined four separate vulnerabilities to progress from browser memory corruption to code execution outside the browser's security sandbox.
The chain began with a memory-corruption flaw in V8, Chrome's JavaScript engine. A second vulnerability allowed the exploit to escape V8's memory sandbox and gain control over the browser component responsible for rendering webpages.
The exploit then took advantage of a race condition involving CacheStorage. This allowed the compromised component to access memory it should not have been able to reach and determine the memory layout of a more privileged browser process.
Finally, a use-after-free vulnerability in Federated Credential Management, or FedCM, enabled the exploit to execute code outside the browser sandbox.
Anthropic says it reported 62 vulnerabilities to Google that had received CVE identifiers and were fixed as of Chrome 156. The company describes these vulnerabilities as critical or high severity, including 13 sandbox escapes.
Google's release notes independently credit Xinyang Ge of Anthropic, assisted by Claude, for specific Chrome fixes. That acknowledgement does not independently establish that Claude discovered or developed every vulnerability included in Anthropic's broader count.
Safari Flaw Could Expose Data Across Websites
The Safari demonstration followed a different approach. Instead of executing code on the victim's computer, the exploit chain reportedly gained read and write access to browser memory and modified a value that disabled the browser's same-origin policy.
The same-origin policy is a fundamental browser security mechanism that prevents one website from accessing sensitive information belonging to another website without authorization.
According to Anthropic, disabling this protection could allow a malicious webpage to access browsing history and cookies and send authenticated requests to other websites where the user is signed in.
Apple addressed the central use-after-free vulnerability in iOS and iPadOS 26.5.2. Its security advisory credits Milad Nasr and Nicholas Carlini, working with Claude at Anthropic, for the reported issue.
The demonstration highlights the potential consequences of browser security flaws that undermine isolation between websites, particularly when users are logged in to email, financial services, or other sensitive accounts.
Android Demonstration Targeted Locked Devices
Anthropic also described an Android exploit chain that could extract photos and other data from a locked, stolen phone.
Unlike the browser demonstrations, this attack required physical access to the device and a USB connection. The reported scenario therefore differs from a fully remote compromise, as an attacker would first need access to the target phone.
Anthropic says Google fixed the vulnerability. However, the report did not identify a publicly available advisory that independently confirms the specific issue and its remediation.
Windows Vulnerability Could Enable Remote Denial of Service
The Windows demonstration focused on a remotely exploitable denial-of-service vulnerability. Anthropic says a small number of network packets could crash a server, while repeated attempts could keep it unavailable.
The reported issue did not provide code execution or data theft. Its primary impact was disrupting the availability of a vulnerable system.
Anthropic associates the demonstration with CVE-2026-33096 and describes the underlying problem as an out-of-bounds read in the Windows kernel's QUIC handling.
However, the public CVE record identifies HTTP.sys, Windows' built-in HTTP request-processing component, and assigns the vulnerability a CVSS score of 7.5. The public record does not name a researcher who discovered the issue.
The available information does not independently establish that the component described in the public CVE record is the same component identified in Anthropic's technical account. The connection between the demonstration and the vulnerability therefore rests on Anthropic's report.
As of the reporting period described by the company, the vulnerability was not marked as exploited in the U.S. government's vulnerability enrichment data and was not listed in CISA's Known Exploited Vulnerabilities catalog.
Linux Exploit Chain Achieved Root-Level Access
The Linux demonstration had the most severe reported impact because it achieved remote command execution with root privileges without requiring authentication or user interaction, provided the target system met the necessary conditions.
The server needed to be running a multipath TCP listener. According to Anthropic, the exploit first disclosed a kernel memory address, helping it bypass Kernel Address Space Layout Randomization, or KASLR.
KASLR is a security feature that randomizes the locations of important kernel components in memory, making it harder for attackers to predict where vulnerable code and other targets reside.
After obtaining the necessary address information, the exploit reportedly reused a race-condition vulnerability to redirect program execution toward attacker-controlled code. The process ultimately produced a root shell.
Anthropic says its proof of concept took approximately 48 minutes to disclose the memory address and another five minutes to obtain the shell. The company also reported that unsuccessful attempts did not crash the system, allowing the exploit to be retried.
The research associates this chain with CVE-2026-98432, a kernel use-after-free vulnerability rated 9.8 and fixed upstream on October 15.
However, the public vulnerability record describes a fix involving IPv4 TCP rather than multipath TCP. The relationship between that record and Anthropic's described exploit chain is established in the company's report but is not independently demonstrated by the public record cited in the article.
Anthropic Says the Research Could Help Defenders
Anthropic presents the findings as evidence that advanced AI systems could help security teams identify complex vulnerabilities and develop reproducible demonstrations of their impact.
The company says it followed a coordinated disclosure process, giving developers 90 days to address reported vulnerabilities and an additional 45 days before discussing details beyond a public advisory.
It has also highlighted its expanded Cyber Verification Program, which provides vetted security professionals with access to selected AI models for cybersecurity work.
The program is intended to support legitimate security research and defensive testing, including the identification and remediation of vulnerabilities before attackers can exploit them.
Questions Remain About AI's Role in Exploit Development
The findings raise questions about how much of the vulnerability discovery and exploit development process advanced AI models can perform independently.
Anthropic argues that the model demonstrated an ability to connect multiple flaws into working exploit chains, a task traditionally associated with highly specialized security researchers.
However, the company has not published a step-by-step account separating the model's contributions from those of human researchers. The findings also rely partly on Anthropic's own technical descriptions, and some connections between the demonstrations and public vulnerability records remain unverified.
Nevertheless, the reported work illustrates why organizations need to prioritize security updates, maintain accurate inventories of exposed systems, and validate mitigations against confirmed vendor advisories.
As AI-assisted vulnerability research advances, the same capabilities may help defenders identify weaknesses more quickly. They could also lower the effort required to develop sophisticated exploits, increasing the importance of timely patching, robust security controls, and responsible vulnerability disclosure.
