An internal, unreleased AI model developed by Anthropic successfully uncovered security flaws in major browsers and operating systems—including Chrome, Safari, Android, Windows, and Linux—and stitched them together into working proof-of-concept (PoC) exploits. None of these exploits have been seen in the wild; each was discovered in lab settings and reported to the respective vendors, and as of today, all vulnerabilities have been patched. One PoC could even launch the Calculator app on a stock Mac via Chrome with no clicks.
What Was Found and How Complex the Chains Were
Anthropic’s Frontier Red Team documented five separate exploit “chains,” each tailored to a specific platform and each involving multiple individual flaws chained together rather than a single vulnerability. The most advanced example came from the Chrome chain: the model first compromised the V8 JavaScript engine, then escaped the memory sandbox, used a CacheStorage race condition to glean browser process memory layout, and finally, exploited a use-after-free bug in FedCM to execute code outside of Chrome’s sandbox. Anthropic reported 62 bugs to Google—across Chrome 156—many rated critical or high, including 13 sandbox escapes.
The Safari chain did not execute code outright, but achieved full read/write access in browser memory and disabled the same-origin policy. This policy normally prevents one site from accessing data from another, even when cookies or login sessions are active. Apple credited two researchers affiliated with Anthropic’s Claude model for the use-after-free bug central to the chain, fixed in iOS and iPadOS version 26.5.2.
On Linux, the model uncovered a severe chain that allowed remote root command execution without any human login or user interaction—but only if the server was running a multipath TCP listener. It began with leaking a kernel address to defeat KASLR (address space layout randomization), then reusing a race condition to hijack execution flow. The full exploit took about 48 minutes to leak the address and another five minutes to trigger the root shell. The issue was patched in the kernel under CVE-2026-98432.
Platform Breakdown & Fixes
Here’s a quick rundown of what each chain was able to do, what conditions were required, and where the fixes landed:
- Chrome: Execute code outside the browser sandbox (one click or even just a web page load on stock Chrome for macOS). Fixed in Chrome 156. Vendors credited Anthropic & Claude for some fixes.
- Safari: Read data across other signed-in sites (email, bank) by disabling the same-origin policy after chain of flaws. Requires visiting a malicious page. Bug fixed in iOS/iPadOS 26.5.2.
- Android: Copy files like photos off a locked, stolen device when connected via USB. Physical access needed. Google claims it’s fixed; no public record found.
- Windows: Denial-of-service exploit via network packets through HTTP/3, causing crashes. Doesn’t execute code or leak data. Associated with CVE-2026-33096.
- Linux: Remote root shell without login or user action—multipath TCP listener required. Leaks kernel address then exploits race condition. Fixed under CVE-2026-98432.
Anthropic emphasized that while the model chains were triggered with only “initial prompting” and minimal human input, the company is opaque on exactly how much guidance or engineering involvement there was per stage. And in some cases, public bug records are thin on attribution—particularly for the Windows flaw, where the official CVE does not list a finder, despite Anthropic’s internal claim.
Implications & Industry Response
All affected vendors have credited Anthropic or its Claude family of models for specific patches. The company claims it followed a coordinated disclosure policy: 90 days to patch internally, then 45 days after an advisory before broader disclosure. It also points to its Cyber Verification Program, which gives vetted external parties access to its advanced models (Claude Opus 5.5, Sonnet 5.5, Mythos 5.1) for security testing.
No evidence has emerged that any of these flaws were being exploited in the wild. U.S. governmental agencies also regard the Windows bug as unexploited and absent from catalogs of known exploited vulnerabilities.
These exploit chains mark a milestone: this level of model-built chaining—especially with only minimal prompting—has so far been largely the domain of human specialists. Demonstrating this capability in lab settings suggests AI models are reaching new degrees of autonomy in vulnerability discovery.
Why this matters: AI tools being able to discover and chain multiple vulnerabilities into a full exploit changes the threat landscape. It means fewer handoffs between discovery and exploitation, potentially accelerating window—from bug to exploit. Defense and patching processes will need to adapt. Going forward, transparency around model involvement, rigorous external validation, and tighter disclosure policies will become ever more critical.
