An unreleased AI model developed by Anthropic has unearthed security vulnerabilities across multiple platforms, including Chrome, Safari, Android, Windows, and Linux. The company disclosed these findings in a recent report and emphasized that these flaws were only utilized in a controlled lab environment to create proof-of-concept exploits.
Security Flaws and Vendor Collaboration
The identified exploits were never seen in actual attacks, as Anthropic ensured that all discovered vulnerabilities were reported to the respective vendors, leading to timely patches. For instance, one exploit was able to launch the Calculator application on a Mac running Chrome almost instantaneously upon loading a webpage, without any additional user input.
The report from Anthropic’s Frontier Red Team described five separate exploit chains. The notable achievement is not attributed to any single vulnerability, but rather the AI model’s ability to discover and combine multiple issues into a cohesive exploit. This task, traditionally handled by specialized teams, now demonstrates the AI model’s advanced capabilities, according to Anthropic.
Patch Verification and Model Capabilities
Both Apple and Google have publicly acknowledged the role of Anthropic and its model, named Claude, in addressing specific security flaws. However, Anthropic has not disclosed the full extent of the AI’s involvement in each step of the process, describing the model as requiring just initial prompts and minimal human input.
One flaw, documented as a Windows bug, lacks attribution in public records, pointing solely to the CVE-2026-33096 vulnerability. This highlights the challenge in independently verifying the AI’s contributions.
Detailed Exploit Chains
The Chrome exploit chain involved four distinct vulnerabilities. Initially, a malicious webpage corrupted V8, Chrome’s JavaScript engine. Subsequent flaws allowed the exploit to bypass Chrome’s memory sandbox, manipulate the browser’s process layout, and ultimately execute code beyond the sandbox. Google acknowledges 62 reported flaws from Anthropic, with 13 involving sandbox escapes.
In contrast, the Safari exploit chain did not execute code but instead manipulated memory to disable the same-origin policy, enabling unauthorized data access. Apple has since resolved this in iOS and iPadOS updates, crediting Anthropic for the discovery.
Implications for Cybersecurity
The Linux exploit, deemed the most severe, allowed root-level command execution without user interaction, contingent on the presence of a multipath TCP listener. The AI model’s proof-of-concept demonstrated a methodical approach to bypassing security measures and gaining unauthorized access, prompting a swift patch deployment.
Anthropic positions its findings as beneficial for cybersecurity, adhering to disclosure policies that afford developers time to address vulnerabilities. The company also advocates for its expanded Cyber Verification Program, offering authorized security professionals access to advanced AI models like Claude Opus 5.5. By sharing these insights, Anthropic emphasizes the potential for AI-driven models to redefine the landscape of security threat detection and mitigation.
