Anthropic says an unreleased internal AI model discovered and combined vulnerabilities into working exploits against Chrome, Safari, Android, Windows and Linux. The demonstrations included running code outside Chrome’s sandbox, extracting data from a locked Android phone and executing commands as root on a Linux server.
The company’s research post describes laboratory proofs of concept, with different access requirements for each target. Anthropic says it reported the vulnerabilities to the vendors and that fixes are available for all five cases. These are research demonstrations, not reported attacks against users.
The central capability claim—that the model assembled sophisticated exploit chains after initial prompting and with little human involvement—comes from Anthropic. The company does not identify the model beyond calling it an internal research model or provide a step-by-step accounting of human assistance.
Browser exploits crossed different security boundaries
In the Chrome demonstration, Anthropic says a page opened in a stock, default-configuration browser on macOS launched Calculator within seconds, without further interaction. That demonstrated code execution as the user outside the browser’s sandbox, the boundary intended to contain compromised web content.
The chain combined four vulnerabilities. A V8 JavaScript engine flaw corrupted memory; a second escaped V8’s memory sandbox and enabled control of the renderer process. A CacheStorage race condition then exposed memory information about the more privileged browser process. Finally, a use-after-free vulnerability in FedCM, Chrome’s federated sign-in feature, enabled code execution outside the process sandbox.
Anthropic says its broader Chrome research produced 62 assigned CVEs, all rated critical or high and patched as of Chrome 156. Those included 13 sandbox escapes and 21 vulnerabilities that could compromise the renderer.
The Safari demonstration targeted data access without relying on arbitrary code execution. Anthropic says the chain combined a JavaScriptCore use-after-free, weaknesses involving WebKit’s Gigacage memory protection and a sandbox communication vulnerability. It accessed stored history, cookies and session databases, then changed a security flag to disable the same-origin policy—the rule preventing one website from reading another website’s data.
That would let a malicious page send authenticated requests to other sites and read their responses. Anthropic gives examples of reading email or viewing bank balances and attempting transfers when the user is already signed in; it does not report actual account theft or transfers.
Anthropic says Apple’s fix is available. The Hacker News reports that Apple fixed the central use-after-free in iOS and iPadOS 26.5.2, released June 29, and credited “Milad Nasr and Nicholas Carlini with Claude, Anthropic.”
Android required physical access; server attacks required listeners
The Android exploit required physical access to a locked phone over USB. Anthropic says its work included testing on a Google Pixel 9, alongside source analysis and reverse engineering of Google Play services.
The exploit bypassed restrictions on USB transfers from locked devices, peer authorization and verification of a six-digit pairing code. It then used a fallback mechanism to retrieve file contents despite a separate restriction on carrying those contents over USB. Anthropic says this allowed extraction of photos and other personal information without unlocking the phone, and that Google has addressed the issue. It does not name a fixed Android release or establish that every Android device was affected.
The Windows demonstration had a narrower consequence: denial of service. Anthropic says a few packets could crash and restart a machine responding to HTTP/3 requests through the native Windows implementation. Repeating the requests could keep the server unavailable; the demonstration did not establish code execution or data theft.
Anthropic identifies the flaw as CVE-2026-33096 and describes an out-of-bounds read in the Windows kernel’s QUIC implementation. The Hacker News reports that the public record instead names HTTP.sys, Windows’ web request handler, and gives an April 2026 patch date. Its reporting does not establish how those component descriptions correspond, and the record names no finder. The attribution to Anthropic therefore rests on the company’s account.
For Linux, Anthropic says the target needed a multipath TCP listener. Its exploit reused a race condition-induced use-after-free first to disclose a kernel address and bypass kernel address randomization, then to redirect execution and run an attacker-chosen command as root without credentials or user interaction.
In the company’s proof of concept, leaking the address took 48 minutes and reaching command execution took another five. Anthropic says unsuccessful attempts failed the handshake without crashing the system, allowing retries.
The company associates that chain with CVE-2026-98432 and says the fix was applied upstream and backported to all maintained stable kernel branches. The Hacker News reports an October 15 upstream patch date, but also notes that the public CVE record describes an IPv4 TCP fix rather than a multipath TCP flaw. The connection between that identifier and the demonstrated chain rests on Anthropic’s post; the two descriptions should not be treated as an independently confirmed affected-product scope.
