Summary
- The work covers Chrome, Safari, Android, Windows and Linux.
- The chains demonstrate different impacts, including execution, data exposure and denial of service.
- Anthropic says it reported vulnerabilities to vendors under coordinated disclosure.
Anthropic has described five exploit chains developed using an unreleased internal AI research model, covering vulnerabilities in Chrome, Safari, Android, Windows and Linux. The company says the work enabled impacts ranging from remote code execution to information disclosure and denial of service, and that the relevant weaknesses were reported to software suppliers through coordinated vulnerability disclosure.
The research, published on 27 October, is not a claim that the model carried out uncontrolled attacks against users. Anthropic’s Frontier Red Team tested the model in research environments and worked with affected vendors on patches before releasing the technical account. The company presents the results as evidence that advanced models can combine separate software weaknesses into exploitation paths with limited human involvement after initial prompting.
In Chrome, the model assembled a multi-stage chain that ultimately escaped the browser sandbox and executed code with the user’s privileges on macOS. The chain combined weaknesses involving JavaScript memory safety, mitigations around the renderer, information leakage and another browser component. Anthropic says Google assigned and patched 62 CVEs identified through the wider research effort by Chrome 156, of which the showcased demonstration is one part.
The Safari work reached a different outcome. Rather than relying on arbitrary native-code execution, the model chained weaknesses that undermined the browser’s same-origin restrictions, allowing one webpage to read information normally isolated to another origin. The demonstration included access to browsing history, cookies and authenticated web responses. Anthropic says Apple acknowledged the findings and issued a fix, limiting the relevance of the original proof of concept to versions that had not received that protection.
On Android, the model investigated interactions between the operating system and device-to-device transfer mechanisms. Testing on a Pixel phone produced a chain that could retrieve photos and other information from a locked device using a connected USB host. The demonstration therefore involved possession of the device and a physical connection; describing it as a remote compromise of arbitrary Android phones would materially misstate the attack conditions. Anthropic says Google addressed the issues.
In the Windows case, the model found an out-of-bounds read in the kernel’s QUIC implementation that could remotely crash servers using native HTTP/3 support. Microsoft patched the issue as CVE-2026-33096. A separate Linux result involved remote code execution through a multipath TCP listener, using CVE-2026-98432, which Anthropic says was patched upstream and backported to supported kernel branches. The attacks had different prerequisites and consequences despite both originating in model-assisted research.
Models that find and combine vulnerabilities could accelerate both discovery for maintainers and attempts against systems that remain unpatched. Models capable of finding and combining flaws could help maintainers uncover dangerous paths earlier, but the same underlying analytical capability can be useful to adversaries searching for unpatched systems. Responsible disclosure, patch deployment and restricted access to highly capable models become closely connected operational concerns. The demonstrations do not establish that all attackers already possess equivalent models or that their real-world success rates match controlled research results.
Under Anthropic’s coordinated disclosure policy, maintainers ordinarily have a target period of 90 days before public disclosure of a vulnerability, with earlier disclosure possible after a patch. The company generally waits a further 45 days after a patch before publishing full technical details, allowing downstream users time to deploy fixes. The policy contains exceptions and extensions for urgent exploitation, ongoing remediation and complex ecosystem-wide findings; those intervals are not an unconditional rule for every report.
Anthropic also maintains a disclosure programme and ledger for findings from its models, reflecting the substantial human work needed to validate reports and coordinate fixes. The five public examples are selected demonstrations, not an exhaustive measure of every model discovery. Their relevance for enterprise users lies in the software they rely on and the time between a fix being available and reaching managed devices. The research leaves open how quickly similar capabilities will spread beyond the controlled environments described by Anthropic.
