The Pulse
Anthropic Says Claude Chained Exploits Across Five Platforms
Anthropic says an unreleased research model developed five exploit chains affecting Chrome, Safari, Android, Windows and Linux. The company reports that vendors addressed the vulnerabilities and describes the model’s role and the human work
AI.info Team · Written with AI · fact-checked ·
“Frontier models have the ability to discover and combine multiple vulnerabilities into a working exploit.”
Anthropic, the company
Anthropic published that assessment on October 27, alongside details of five exploit chains developed with an unreleased internal research model. The targets were Chrome, Safari, Android, Windows and Linux. The company says the chains produced remote code execution or other serious effects, in some cases with little or no action from a user.
Anthropic says it reported each vulnerability to the affected vendor under its coordinated disclosure process. Its post says the flaws have been patched or addressed. The company does not identify the model by name, and does not provide a step-by-step account of how much human work went into each chain.
Four flaws put Chrome outside its sandbox
Anthropic’s Chrome example chains four vulnerabilities to move from a malicious web page to code execution outside the browser’s sandbox. The chain starts with a flaw in V8, Chrome’s JavaScript engine, that could corrupt memory. Further bugs let the exploit escape V8’s memory protections, access information about the browser process and then run code beyond the sandbox.
Anthropic says it reported 62 vulnerabilities to Google, all rated critical or high and patched as of Chrome 156. The company says 13 were sandbox escapes and 21 could have been used to compromise Chrome’s renderer. In its proof of concept, the Calculator app opened on a Mac running a stock, default-configured Chrome installation within seconds of a page loading.
The Safari chain had a different result: it did not execute arbitrary code. Instead, the exploit combined flaws to read and write browser memory and disable the same-origin policy, which normally prevents one website from accessing another site’s data. Anthropic says a malicious page could then access Safari history, cookies and session data, and make authenticated requests to other domains.
Android required access to the locked phone
On Android, the exploit depended on physical access to a locked phone. Anthropic’s team analyzed open-source Android code, reverse-engineered Google Play services binaries and tested the attack on a physical Pixel 9. The resulting chain bypassed protections around USB transfers, device pairing and file access, allowing an attacker to extract photos and other personal information without unlocking it.
Anthropic says Google has addressed the issue. The company’s account describes a combination of weaknesses across open-source and proprietary components, rather than a single break-in point. That distinction matters: the reported exploit worked by slipping past several checks that are meant to stop a connected device from transferring private files.
Windows could crash; Linux could run commands as root
The Windows finding had a narrower impact than the others. Anthropic says the model found a memory-safety flaw in the Windows kernel’s QUIC implementation that could let an attacker crash a machine remotely with a few network packets, then keep it unavailable by repeating the requests. The flaw affected machines responding to HTTP/3 requests through Windows’ native implementation; Anthropic estimates several million such servers may be listening on the internet. Microsoft resolved the vulnerability and assigned it CVE-2026-33096.
Anthropic describes the Linux example as a zero-click route to arbitrary command execution as root on servers running a multipath TCP listener. A race condition in the kernel networking stack first let the exploit expose a kernel memory address, then redirect execution to a payload already placed in kernel memory. In the company’s proof of concept, the address leak took 48 minutes and reaching command execution took another five.
Anthropic leaves the model and human role unspecified
The report argues that models can now combine vulnerabilities into working exploits, a task Anthropic says has historically belonged to specialist teams. The company says its work used parallel scanning agents, different search strategies and a standardized verification and risk-rating process. It recommends scanning code during the development process, not only working through vulnerabilities already found.
But the post offers no breakdown of the prompting, engineering or debugging that went into each result, and names no model version. Anthropic says the work required “initial prompting” and describes the model as operating with “little human involvement”; readers cannot use the report to compare the five chains’ degree of autonomy. The concrete record in the post is five reported chains, vendor fixes and a Linux proof of concept that took 53 minutes to reach a root command.