Anthropic Says Unreleased AI Model Chained Flaws Into Working Exploits

Summary

Anthropic says an unreleased model found flaws across major platforms and built lab-only proof-of-concept chains; vendors patched the reported flaws. Claims about the model's autonomy and links between some chains and public CVE records remain unverified.

Key points

Anthropic describes five lab-built exploit chains and says the model needed little human involvement; it does not detail the human contribution or identify the model.
The Chrome chain combines four flaws, including V8 memory corruption, a CacheStorage race and a FedCM use-after-free. Google credits Anthropic and Claude for some fixes, not all 62 flaws Anthropic says it reported.
The Safari chain obtains browser-memory access and changes a value to disable the same-origin policy, potentially exposing history and cookies. Apple credited Anthropic researchers with a fix.
The Windows chain is a denial-of-service, not code execution or data theft. Anthropic describes a QUIC flaw, while CVE-2026-33096 names HTTP.sys; the article says the public record does not connect the descriptions.
The Linux chain can reach root command execution over the network but requires a multipath TCP listener. Anthropic links it to CVE-2026-98432, whose public record describes a different-seeming IPv4 TCP fix.
Anthropic says vendors patched the flaws and the proof-of-concepts were not observed in real attacks. As of late October, the Windows flaw was marked not exploited and was absent from CISA's known exploited vulnerabilities catalog.

Article Details

Event Type: Anthropic reported that an unreleased internal AI research model found and chained security flaws into five working proof-of-concept exploits in a laboratory setting.
Impact: The reported chains affected Chrome, Safari, Windows, and Linux. Their demonstrated impacts included browser memory access and bypass of the same-origin policy, a Windows denial of service, and unauthenticated remote command execution as root on a Linux server with a multipath TCP listener. Anthropic said the flaws had been reported to vendors and were patched; the article reports no real-world attacks.