Anthropic Says Claude Built Five Exploits Across Major Browsers and Operating Systems
Summary
Anthropic says an unreleased Claude model built five chained exploits across Chrome, Safari, Android, Windows and Linux; vendors have patched the flaws. Experts note the claims of autonomous discovery lack success-rate and effort data.
Key points
- Anthropic said Claude generated five working exploits targeting Chrome, Safari, Android, Windows and Linux; it said affected vendors have addressed the vulnerabilities.
- Anthropic described a Chrome-on-macOS chain combining four vulnerabilities to escape the browser sandbox; a proof of concept launched macOS Calculator from a malicious webpage.
- Anthropic said a Safari chain bypassed the same-origin policy, potentially exposing browsing history, cookies and session data. Apple has fixed the issue, according to Anthropic.
- Anthropic said an exploit targeting a locked Google Pixel 9 chained three Android vulnerabilities to extract photos and other personal information; it involved a stolen phone and USB cable.
- The reported Windows flaw could let an attacker crash vulnerable servers with crafted network packets. Anthropic said the Linux exploit could enable unauthenticated, zero-click commands with root privileges; it identified the flaw as CVE-2026-98432.
- An industry expert said the public fixes support parts of Anthropic's account, but autonomous discovery claims are Anthropic's own; the report did not provide success rates, costs or human-hours per exploit chain.
Article Details
- Event Type
- Anthropic reported that an unreleased Claude model generated five working exploit chains targeting Chrome, Safari, Android, Windows, and Linux.
- Impact
- The reported exploits could escape Chrome’s browser sandbox, bypass Safari’s same-origin policy to access browsing data, extract personal information from a locked Android phone, execute commands with root privileges on Linux servers, and crash Windows systems. Anthropic said the affected vendors addressed the vulnerabilities. Andrew Bolster noted that the fixes are publicly verifiable, while claims that Claude discovered the vulnerabilities autonomously are Anthropic’s own.
CVE
People
Andrew BolsterSenior R&D manager at Black Duck; commented on the verifiability of the reported fixes and limitations in the evidence for Claude’s autonomous discovery claims.Jacob KrellSenior director of secure AI solutions and cybersecurity at Suzu Labs; commented on the gap between proof-of-concept exploits and reliable attacks.John StrandOwner of Black Hills Information Security; commented on AI-assisted vulnerability research and implications for defenders.
Vendors
Anthropicand operating systems and chained them into working exploits requiring little or no human interaction, Anthropic said this week.AppleApple has since fixed the issue, Anthropic said.GoogleAnthropic said it reported 62 vulnerabilities to Google, all of which had been assigned CVE identifiers, rated high or critical, and patched by Chrome 156.MicrosoftClaude's Windows exploit, which Microsoft has patched, involved a remotely exploitable denial-of-service (DoS) vulnerability. The flaw was an out-of-bounds read in the Windows kernel's implementation of the transport
Products
AndroidThe exploits included one that enabled data theft from a locked Android smartphone, another zero-click exploit allowed remote code execution (RCE) with root privileges on Linux servers, and a third that could haveGoogle Chromecrash Windows systems. In total, Anthropic said, the model generated five working exploits targeting Chrome, Safari, Android, Windows, and Linux. All affected vendors have addressed the vulnerabilities afterGoogle Pixel 9The Android exploit, meanwhile, targeted a locked Google Pixel 9. Claude chained three vulnerabilities in Android's device-transfer and USB-handling mechanisms, bypassing four layers of protection to extract photos andLinuxsmartphone, another zero-click exploit allowed remote code execution (RCE) with root privileges on Linux servers, and a third that could have allowed attackers to remotely crash Windows systems. In total,macOSAnthropic's report described a one-click RCE exploit chain involving Chrome on macOS. The exploit combined four vulnerabilities in Chrome's JavaScript engine, memory protections, browser process isolation, and federatedMicrosoft Windowswith root privileges on Linux servers, and a third that could have allowed attackers to remotely crash Windows systems. In total, Anthropic said, the model generated five working exploits targeting Chrome, Safari,SafariWindows systems. In total, Anthropic said, the model generated five working exploits targeting Chrome, Safari, Android, Windows, and Linux. All affected vendors have addressed the vulnerabilities after Anthropic