- An unreleased Anthropic AI model chained separate flaws into working proof-of-concept exploits affecting Chrome, Safari, Android, Windows and Linux.
- Anthropic said the exploits were built in a lab after prompting and were not seen in any real attack.
- Anthropic said every flaw was reported to the relevant vendor first and all were already patched.
Anthropic said an unreleased AI model found security flaws in Chrome, Safari, Android, Windows and Linux and chained them into working proof-of-concept exploits.
Anthropic said the exploits were built in a lab after prompting and were not seen in any real attack.
The research covered five exploit chains, including one that opened the Calculator app on a stock Mac running Chrome within seconds of a page loading, with no further clicks. Anthropic said it reported every flaw to the relevant vendor first and that all the flaws were already patched.
On this page
Anthropic’s chains reached a root shell and a Mac app
Anthropic said its Linux proof of concept took 48 minutes to leak a kernel address and five more minutes to reach a root shell. The company said a failed attempt does not crash the system, so an attacker can keep retrying.
The Linux chain involved CVE-2026-98432, a kernel use-after-free rated 9.8 and fixed upstream on Oct 15.
Google fixed 62 flaws reported by Anthropic, it said
Anthropic said Google assigned CVEs to and fixed 62 flaws as of Chrome 156, all rated critical or high, including 13 sandbox escapes.
Anthropic said models now need little human involvement
Anthropic said models can perform this work with little human involvement and prove it by producing a working exploit that anyone can run and verify. The company’s Frontier Red Team described five chains in a research post.
Anthropic said one model found several separate flaws and combined them into a working exploit.
Anthropic said its coordinated disclosure policy gives developers 90 days to patch and 45 more days before it discusses details beyond a public advisory.
Anthropic directed security teams to its expanded Cyber Verification Program, which gives vetted professionals access to Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1.
FAQ
What did Anthropic’s AI model find?
Anthropic said an unreleased model found flaws in Chrome, Safari, Android, Windows and Linux and chained them into working proof-of-concept exploits.
Were the Anthropic AI exploits used in real attacks?
Anthropic said the exploits were built in a lab after prompting and were not seen in any real attack.
Which Linux vulnerability was used in the chain?
Anthropic tied the Linux chain to CVE-2026-98432, a kernel use-after-free rated 9.8 and fixed upstream on Oct 15.
How fast could the Chrome proof of concept act?
Anthropic said one proof of concept opened the Calculator app on a stock Mac running Chrome within seconds of a page loading, with no further clicks.
How many flaws did Google fix from Anthropic’s reports?
Anthropic said Google assigned CVEs to and fixed 62 flaws as of Chrome 156, all rated critical or high, including 13 sandbox escapes.
Sources
- Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits, The Hacker News
- An unreleased Anthropic model made progress on one of math’s biggest unsolved problems, TechCrunch
- Anthropic has an unreleased model that infers users’ goals from sparse instructions, Crypto Briefing
- Unreleased Claude Model Makes Breakthrough on 167-Year-Old Math Problem, eWeek
- Anthropic’s next AI model reportedly targets intent as Google and OpenAI prepare rivals, Tbreak
How we checked this story
| Claim | Source | Status |
|---|---|---|
| Anthropic said an unreleased AI model found security flaws in Chrome, Safari, Android, Windows and Linux and chained them into working proof-of-concept exploits. | Anthropic, via The Hacker News | Attributed |
| Anthropic said the exploits were built in a lab after prompting and were not seen in any real attack. | Anthropic, via The Hacker News | Attributed |
| Anthropic said it reported every flaw to the relevant vendor first, and all the flaws were already patched. | Anthropic, via The Hacker News | Attributed |
| Anthropic said one proof of concept opened Calculator on a stock Mac running Chrome within seconds of a page loading without further clicks. | Anthropic, via The Hacker News | Attributed |
| Anthropic’s Frontier Red Team described five exploit chains. | Anthropic, via The Hacker News | Attributed |
| Anthropic said the model found several separate flaws and combined them into a working exploit. | Anthropic, via The Hacker News | Attributed |
| Anthropic said Google assigned CVEs to and fixed 62 flaws as of Chrome 156, all rated critical or high, including 13 sandbox escapes. | Anthropic, via The Hacker News | Attributed |
| Anthropic said its Linux proof of concept took 48 minutes to leak a kernel address and five more minutes to reach a root shell. | Anthropic, via The Hacker News | Attributed |
| Anthropic said a failed Linux exploit attempt does not crash the system, allowing repeated attempts. | Anthropic, via The Hacker News | Attributed |
| Anthropic said its coordinated disclosure policy gives developers 90 days to patch and 45 more days before discussing details beyond a public advisory. | Anthropic, via The Hacker News | Attributed |
| Anthropic directed security teams to its expanded Cyber Verification Program, which gives vetted professionals access to three Claude models. | Anthropic, via The Hacker News | Attributed |
| Anthropic said models can perform this work with little human involvement and prove it by producing a working exploit. | Anthropic, via The Hacker News | Attributed |
| Anthropic tied the Linux chain to CVE-2026-98432, a kernel use-after-free rated 9.8 and fixed upstream on October 15. | Anthropic, via The Hacker News | Attributed |
| eWeek said Anthropic’s internal research version of Claude increased the known lower bound for a related Riemann zeta function question from 41.6% to 67.2%. | Anthropic, via eWeek | Attributed |
| eWeek said Anthropic’s research model generated 31 million output tokens across two Claude Code sessions. | Anthropic, via eWeek | Attributed |
| eWeek said the work was initiated by an Anthropic staff member without significant mathematical training and continued autonomously for about a day and a half. | Anthropic, via eWeek | Attributed |
| eWeek said Anthropic mathematicians Levent Alpöge and Ralph Furman reviewed the result. | Anthropic, via eWeek | Attributed |
| eWeek said Anthropic shared the paper with outside experts Brian Conrey and Dan Goldston. | Anthropic, via eWeek | Attributed |
| TechCrunch said the model coordinated the task across the following day and a half after an Anthropic staff member prompted it. | Anthropic, via TechCrunch | Attributed |
| TechCrunch said two Anthropic in-house mathematicians confirmed the finding and Lean formalized it. | Anthropic, via TechCrunch | Attributed |
| Crypto Briefing reported that the unreleased model had not been publicly named or benchmarked. | Crypto Briefing | Attributed |
Could not verify
- Whether the five chains correspond to the cited CVE records is not established.
- How much of each exploit chain the model built without human involvement is not established.
- Whether any of the flaws were exploited in real-world attacks is not established.
Related stories
Vulns & PatchesPHP flaws could run code after CISA added two CVEs to KEV
Vulns & PatchesInterSystems IRIS for Health flaw could expose data and log in
Vulns & PatchesNode.js Brotli flaw could enable remote code execution