Unreleased Claude model found attack chains in Chrome, Safari: Anthropic

Anthropic says Claude chained software flaws into working exploits, highlighting the growing role of AI in vulnerability research and cybersecurity risks

Artificial intelligence (AI) models are moving beyond identifying individual software vulnerabilities to linking multiple flaws and turning them into working exploits. This could help developers strengthen software security, but also raises concerns about potential misuse. In a research report, Anthropic said an unreleased internal Claude model had identified and chained vulnerabilities in widely used software, including Google Chrome, Apple Safari, Android, Windows and the Linux kernel. The company documented five attack chains, with potential consequences ranging from accessing sensitive browser data to running unauthorised code on a system.

 

The report noted that the vulnerabilities to affected vendors and fixes have been issued for several of them. The findings show how AI may help move from finding a flaw to demonstrating how it could be exploited.

 

 

From finding a flaw to building an exploit

 

A software vulnerability is a weakness that may let an attacker crash a service, access information, bypass a security check or run unauthorised commands. A single flaw does not always provide full access because other protections may limit its impact.

 

An exploit takes advantage of a vulnerability. An attack chain links weaknesses so one step enables the next. A flaw might allow code to run inside a browser, while its sandbox blocks access to the rest of the system. A second weakness may help bypass that boundary, making the combined attack more serious.

 

Anthropic said Claude developed multi-step exploits against open-source and proprietary software, with some requiring little or no further user interaction after the initial trigger. The model could investigate a target, test approaches and produce a proof of concept.

 

What Claude found in major software

 

One example involved Google Chrome on macOS. Anthropic said Claude found a chain beginning with a flaw in Chrome's V8 JavaScript engine, which could let a malicious webpage corrupt memory. The model identified additional weaknesses that could help it move beyond the affected memory area, defeat protections and escape the browser's sandbox. Anthropic said its proof of concept could launch the Calculator app from a standard Chrome setup after a webpage loaded, without further user interaction.

 

Anthropic said Google had assigned 62 CVE identifiers to the reported Chrome findings and patched them as of Chrome 156. The group included 13 sandbox escapes and 21 flaws that could be used to compromise the browser's renderer process, according to the company. A CVE is a tracking identifier for a recognised vulnerability.

 

In Safari, Anthropic said Claude built a chain that could bypass the browser's same-origin policy. This policy stops one website from reading another site's sensitive data. According to Anthropic, the exploit could access browsing history, cookies and other stored information, and make authenticated requests to other websites. Apple acknowledged the report and implemented a fix, Anthropic said.

 

The research also described an Android lock-screen bypass. Claude combined weaknesses in open-source Android components and proprietary Google Play services, using code analysis, reverse engineering and tests on a Pixel 9, Anthropic said. The chain could allow someone with a stolen, locked phone to extract photos and other personal information without unlocking it. Google has addressed the issue, according to Anthropic.

 

In Windows, Anthropic said Claude found a flaw in the QUIC network protocol, which helps computers communicate over the internet. An attacker could exploit this weakness to crash a Windows machine when it processes certain HTTP/3 requests. Microsoft fixed the issue and assigned it the identifier CVE-2026-33096.

 

In Linux, Claude found a different type of weakness called a race condition, which occurs when a software system handles operations in an unsafe order or at the wrong time. Anthropic said this flaw could be combined with other weaknesses to let an attacker run commands with root privileges, meaning the highest level of access to a system. The attack could work without login credentials or any action from the user. The flaw, identified as CVE-2026-98432, was patched in the Linux kernel, with fixes also added to maintained versions.

 

The examples show how one flaw can help an attacker cross a security boundary or gain greater access. Impact depends on the software and whether the chain works reliably.  

 

Why the findings matter for defenders

 

AI-assisted vulnerability research can help developers find problems before attackers do. Models can examine code, explore execution paths and help produce proof-of-concept exploits, helping teams assess a weakness and its urgency.

 

But the same capability could reduce the time and expertise needed to build an exploit. Connecting weaknesses into an exploit could make the task more accessible to people with less security research experience. That makes quick reporting, independent validation and timely patching more important.

 

Anthropic said it reported findings to vendors through coordinated vulnerability disclosure, allowing time for fixes before publishing technical details. It also recommended integrating security checks into development and scanning code as changes are proposed.

 

Other AI developers are using models for security research

 

Across the industry, Anthropic's findings follow other efforts by AI developers to use their models for vulnerability research. OpenAI's Patch the Planet initiative uses Codex to identify and validate flaws in browser and operating-system software. OpenAI has reported findings involving Chrome, Safari, Firefox, OpenBSD and FreeBSD. OpenAI said its researchers found five exploitable flaws in Chrome's V8 engine and more than 10 in Safari's WebKit.

 

OpenAI has also said GPT-5.5 identified a WebAssembly vulnerability in Firefox during safety evaluations. Mozilla patched the flaw, tracked as CVE-2026-8390, two days before the Pwn2Own Berlin competition, according to OpenAI. OpenAI said no Firefox exploit was demonstrated at the competition.

 

A separate case illustrates the risk that can follow the discovery of a flaw. Google Threat Intelligence Group reported that a vulnerability autonomously discovered by research firm Hacktron AI affected BeyondTrust's Privileged Remote Access and Remote Support products. The flaw, CVE-2026-1731, was an unauthenticated operating-system command-injection vulnerability. Google said it observed threat actors exploiting it after public disclosure, in campaigns involving initial access to targeted organisations.

 

The race between discovery and repair

 

AI security research creates a race between discovery and repair. Early, reliable reports give software makers time to prepare updates, but risks rise if exploit methods spread before patches.

 

Organisations should update software, prioritise critical fixes, monitor vendor advisories and test exposed systems. Security professionals should verify AI-generated findings carefully before deciding how to respond.

 

Anthropic's research does not mean AI can automatically break into every browser or operating system. It shows that advanced models can help connect separate weaknesses into more complete attack chains. As these tools improve, the challenge will be to ensure defenders can use them to identify and repair flaws at least as quickly as attackers can turn them into exploits.