Anthropic said an unreleased, internal research model built five working exploit chains across some of the world’s most widely used software, in laboratory conditions only. The company’s Frontier Red Team did the work over the past few months, and every flaw was reported to vendors and patched before publication. The chains covered Chrome, Safari, Android, Windows and Linux, and Anthropic framed the result as a capability shift for cyber defence.
The five chains
The Chrome chain is the most striking. After initial prompting, the model found a flaw in Chrome’s V8 JavaScript engine that corrupted heap memory, then a second flaw that broke out of the V8 sandbox and defeated address randomisation. A race condition in CacheStorage then exposed the privileged browser process, and a use-after-free flaw in FedCM finished the escape.
Anthropic said the proof of concept launched the Calculator app from a stock Chrome browser on macOS within seconds of a page loading, with no further user interaction. The company said 62 CVEs were assigned for the Chrome findings, all critical or high severity, patched as of Chrome 156, including 13 sandbox escapes and 21 renderer-compromise bugs.
The Safari chain worked differently. It was a data-only attack that never needed arbitrary code execution. A use-after-free flaw in JavaScriptCore gave the model a foothold, a Gigacage bypass provided read and write access outside the browser’s memory cage, and a flaw in the WebContent sandbox’s messaging let the exploit read history, cookies and session data from disk.
Finally, the model overwrote a variable in memory to disable the same-origin policy, the rule that stops one website reading another site’s data. Anthropic said a malicious page could then read a signed-in user’s email or bank data. Apple acknowledged the report the same day it was submitted and shipped a fix promptly.
The Android chain needed physical access. Tested on a Google Pixel 9, it bypassed the block on USB data transfer from a locked phone, skipped the pairing authorisation check, and dodged the six-digit verification step that asks the user to approve a connection. A fallback USB path then sent raw file bytes, allowing photos and personal data to be extracted.
The Windows chain was a remote denial-of-service flaw rather than a takeover. The model found an out-of-bounds read in the Windows kernel’s QUIC implementation by reverse-engineering a Windows executable with tools such as Ghidra. A few packets sent to an HTTP/3 server could crash and restart it, and Anthropic estimated several million such servers are reachable online.
The Linux chain was the most severe on paper. A race-condition use-after-free flaw in the kernel networking stack, aimed at a multipath TCP listener, let a remote attacker defeat kernel address randomisation in 48 minutes and reach a root shell five minutes later. Failed attempts did not crash the system, so an attacker could retry indefinitely.
What the disclosure does and does not prove
Anthropic’s disclosure followed its coordinated process: vendors received 90 days to patch, plus a further 45 days before details beyond public advisories were discussed. All five sets of flaws were patched before publication, and the company also released a Claude Code security-guidance plugin publicly for defenders, part of a wider push to scan AI-written code before it ships.
Some headline figures still rest on Anthropic’s account alone, and this report reflects that. Independent reporting noted that Google’s Chrome 156 notes credit specific Anthropic-assisted fixes rather than all 62 CVEs, and that public records for the Windows and Linux flaws describe them differently from Anthropic’s write-up.
That caution does not diminish the central claim, which is about capability rather than any single bug. Anthropic argued that building multi-step exploits was historically the work of a few specialist teams, and that models can now do it with little human involvement and then prove it with a working exploit that anyone can run and verify.
Why It Matters
For defenders, the lesson is clear. If a research model can chain flaws across browsers and operating systems, patching speed matters more than ever, and the same models are now being aimed at defence. Google’s own cyber-defence pitch for its newest frontier model, covered in Gemini 4 Carbon’s security push, shows how fast this contest is becoming a selling point.
The work also sharpens the debate about who gets powerful cyber capabilities. Anthropic is channelling its most capable models to vetted defenders through its verification programme, which now includes Opus 5.5, Sonnet 5.5 and Mythos 5.1, while keeping the research model itself unreleased, with no codename and no release date.
Background
Anthropic’s Frontier Red Team tests frontier models against real systems, and this report follows its earlier security research using Claude across widely deployed software.
Source: Anthropic’s research post and The Hacker News report
0 Comments