Anthropic says unreleased AI chained flaws into exploits

Anthropic's Frontier Red Team says an unreleased internal research model found critical flaws in Chrome, Safari, Android, Windows and Linux, then chained them into working proof-of-concept exploits with "little to no user interaction." The company published the findings on Tuesday, October 27, in a research post. It said each flaw was reported to the affected vendor under coordinated disclosure, giving developers 90 days to patch and another 45 days before Anthropic discusses details beyond the public advisory.anthropic.com

The exploits were built in a lab after the model was prompted, and none were seen in real attacks. All of the reported flaws have since been patched, The Hacker News reported. The company has not named the model.thehackernews.com

Linux root shell and a Chrome escape

The most serious chain targets Linux. It lets a remote attacker run commands as root on servers with a multipath TCP listener, with no credentials and no user action. The model first beat a kernel defense called KASLR by leaking a memory address remotely. It then used the same race-condition use-after-free bug to overwrite a callback pointer and launch a root shell, according to Anthropic. The proof of concept took 48 minutes to leak the address and five more to reach the shell. A failed attempt does not crash the machine, so an attacker can keep retrying, Cybersecurity News reported. Anthropic links the bug to CVE-2026-98432, rated 9.8 and patched upstream on October 15. However, the public record describes an IPv4 TCP fix rather than a multipath TCP one, and only Anthropic's post connects the two, The Hacker News noted.cybersecuritynews.com+2

In Google's Chrome, the model chained four bugs, from heap corruption in the V8 engine to a use-after-free in the FedCM sign-in feature. The chain launched the Calculator app on a stock Mac within seconds of a page loading. Google has assigned 62 CVEs that are fixed as of Chrome 156, all rated critical or high, Anthropic said.anthropic.com

Safari, Android and Windows

The Safari chain never runs code. Instead, it switches off the same-origin policy so that a malicious page can read a user's email or bank data. Apple fixed the central bug in iOS and iPadOS 26.5.2. The Android chain pulled data from a locked Pixel 9 over USB. The Windows bug is a denial-of-service flaw that can repeatedly crash HTTP/3 servers. Anthropic ties it to CVE-2026-33096, which Microsoft patched in April, but the public record names HTTP.sys and credits no finder, The Hacker News reported.thehackernews.com

Claims rest on Anthropic's account

Anthropic does not say how much human involvement each chain required, how many runs it took, or how many findings failed verification, Audit Commons noted. Google's and Apple's release notes do credit Anthropic researchers "with Claude" for specific fixes. The company presents the work as help for defenders and points security teams to its expanded Cyber Verification Program. "Now, it's something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify," Anthropic wrote, as quoted by The Hacker News.auditcommons.org+1