Anthropic Says Unreleased AI Model Chained Flaws Into Working Exploits

Anthropic said an unreleased internal research model found security flaws in Chrome, Safari, Android, Windows and Linux and chained them into working proof-of-concept exploits. The company said the work was done in a lab after prompting, was not seen in a real attack, and every flaw was reported to vendors first. All of the flaws are already patched.

Five exploit chains

Anthropic's Frontier Red Team described five chains. One proof of concept opened the Calculator app on a stock Mac running Chrome within seconds of a page loading, with no further clicks. The company said the model found several separate flaws and combined them into a working exploit, something it says has until now been the work of a few specialist teams. That capability claim rests on Anthropic's own account, while patches and vendor credits can be checked with Apple and Google.

Chrome, Safari and Android

In the Chrome chain, the model used four flaws in turn: memory corruption in V8, a sandbox escape, a CacheStorage race condition that leaked memory layout, and a use-after-free in FedCM. Anthropic said it reported 62 flaws to Google that were assigned CVEs and fixed as of Chrome 156, all critical or high, including 13 sandbox escapes. Google credits Xinyang Ge of Anthropic, assisted by Claude, for specific Chrome fixes. The Safari chain never runs code: it gains read and write access to browser memory and turns off the same-origin policy, allowing a malicious page to read history and cookies and send signed-in requests. Apple fixed the central use-after-free in iOS and iPadOS 26.5.2 and credits Milad Nasr and Nicholas Carlini with Claude, Anthropic. For Android, Anthropic said Google fixed a flaw that could copy photos and other data from a locked stolen phone over USB, but no public record was found.

Windows and Linux

The Windows chain is a denial-of-service attack: a few network packets can crash a server that answers HTTP/3 requests, and repeating them keeps it down. Anthropic described an out-of-bounds read in the Windows kernel's QUIC handling, while the public record for CVE-2026-33096 names HTTP.sys and rates it 7.5 out of 10. The CVE credits no finder. The Linux chain can run commands as root over the network without a login if the server runs a multipath TCP listener. The model leaked a kernel address to bypass KASLR, then reused a race-condition bug to reach a root shell; the proof of concept took 48 minutes to leak the address and five more to reach the shell. Anthropic tied it to CVE-2026-98432, rated 9.8, though the public record describes an IPv4 TCP fix rather than a multipath TCP one.

Disclosure and verification

Anthropic said it reported each flaw under coordinated disclosure, giving developers 90 days to patch and 45 more before it discusses details beyond a public advisory. It also pointed security teams to its expanded Cyber Verification Program, which gives vetted professionals access to Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1. The company said models can now do this work with little human involvement and prove it by producing a working exploit that anyone can run and verify. Anthropic said the work needed only initial prompting and little human involvement, but did not break down what a person did at each step and did not name the model beyond calling it an unreleased internal research model.

Sources: The Hacker News