Anthropic AI Chains Vulnerabilities into Exploits for Major Platforms
An unreleased Anthropic AI model has demonstrated the ability to chain together multiple security flaws into functional exploits targeting Chrome, Safari, Windows, and Linux.
Anthropic's Frontier Red Team has revealed that an internal, unreleased AI model successfully identified and chained together various security vulnerabilities across multiple popular platforms, including Google Chrome, Apple Safari, Microsoft Windows, and Linux. In a controlled lab environment, the AI was prompted to discover and combine these flaws into proof-of-concept exploits. While these exploits were not observed in real-world attacks, Anthropic has proactively reported all discovered vulnerabilities to the respective vendors, ensuring that all identified issues have since been patched.
The most significant finding is not the discovery of individual bugs, but the AI's capability to link separate vulnerabilities into a working exploit chain. Anthropic claims this ability, previously the domain of highly specialized security teams, was achieved with minimal human intervention, requiring only initial prompting. The company's research post details five distinct exploit chains, showcasing the AI's prowess in complex vulnerability chaining.
For Google Chrome, the AI model utilized four distinct vulnerabilities. The exploit began by corrupting memory within V8, Chrome's JavaScript engine, followed by a sandbox escape to gain control of the page rendering process. A race condition in the CacheStorage feature then allowed the code to access sensitive memory, revealing the layout of the more privileged browser process. Finally, a use-after-free bug in the FedCM sign-in feature enabled the execution of code outside the browser's sandbox. Anthropic reported 62 CVE-assigned flaws to Google, all rated critical or high, with 13 involving sandbox escapes, and Google's release notes credit Anthropic and its Claude model for specific fixes.
In the case of Apple Safari, the exploit chain focused on achieving read and write access to the browser's memory by chaining vulnerabilities. This allowed the attackers to disable the same-origin policy, a critical security measure that prevents websites from accessing data from other sites. With this policy bypassed, a malicious webpage could potentially read user history, cookies, and send authenticated requests to other services. Apple has since patched the core use-after-free vulnerability in iOS and iPadOS, with Anthropic researchers credited for their contribution.
The Windows exploit chain identified by the AI is a denial-of-service attack. It targets an out-of-bounds read vulnerability in the Windows kernel's QUIC handling, causing the system to crash when receiving specific network packets. Repeating these packets can keep the system down, though it does not allow for code execution or data theft. Anthropic attributes this to CVE-2026-33096, which has been patched, though the public record for the CVE differs slightly in its component description and credits no specific finder.
The Linux exploit chain presents a more severe impact, enabling remote command execution with root privileges on a target server without requiring any login or user interaction. This exploit leverages a multipath TCP listener and involves leaking kernel memory addresses to bypass KASLR, followed by exploiting a race condition to redirect execution to attacker-controlled code, ultimately yielding a root shell. Anthropic links this to CVE-2026-98432, a critical kernel use-after-free vulnerability that has been patched.
Anthropic frames this research as a proactive measure to aid defenders by demonstrating the potential of AI in discovering and chaining complex vulnerabilities. The company adheres to coordinated disclosure policies, providing vendors with ample time to address issues before public disclosure. This work highlights the evolving landscape of cybersecurity, where AI is increasingly becoming a tool for both offense and defense, necessitating continuous adaptation from security professionals.