An unreleased version of Claude identified critical vulnerabilities in some of the world’s most widely used browsers and operating systems and chained them into working exploits requiring little or no human interaction, Anthropic said this week.
The exploits included one that enabled data theft from a locked Android smartphone, another zero-click exploit allowed remote code execution (RCE) with root privileges on Linux servers, and a third that could have allowed attackers to remotely crash Windows systems. In total, Anthropic said, the model generated five working exploits targeting Chrome, Safari, Android, Windows, and Linux. All affected vendors have addressed the vulnerabilities after Anthropic reported them.
The exploits are the latest evidence that frontier AI models are moving beyond simply identifying individual flaws to combining multiple into sophisticated working exploits. “These attack chains demonstrate the model’s ability to create sophisticated, multi-step exploits in both open-source and proprietary software,” Anthropic’s Frontier Red Team said in a blog post this week.
From Vulnerability Discovery to Chained Exploits
Historically, creating such chained exploits would have required special teams with domain expertise, the researchers wrote. “Now, it’s something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify.”
Anthropic’s report described a one-click RCE exploit chain involving Chrome on macOS. The exploit combined four vulnerabilities in Chrome’s JavaScript engine, memory protections, browser process isolation, and federated sign-in functionality.
Each of the vulnerabilities that Claude discovered helped overcome a different security control and allowed the chained exploit to escape the browser’s sandbox. As a proof of concept, Anthropic’s exploit launched macOS Calculator from Chrome when a user loaded a malicious webpage.
Anthropic said it reported 62 vulnerabilities to Google, all of which had been assigned CVE identifiers, rated high or critical, and patched by Chrome 156.
On Safari, Claude’s exploit chain allowed JavaScript on any website to bypass the same-origin policy, a security control that prevents one website from accessing another site’s data. An attacker could have used the exploit to access a user’s browsing history, cookies, and session data, potentially allowing an attacker to read information from authenticated websites.
“For example, if the user is signed in to their email account, the attacker can now read their email; if they’re logged into their bank account, the attacker can view account balances or attempt transfers,” Anthropic said. The exploit chain combined four weaknesses Claude identified in Safari — a use-after-free flaw in Safari’s JavaScriptCore engine, a way to bypass WebKit’s Gigacage memory protection, a vulnerability in the WebContent sandbox, and a JavaScriptCore flaw.
Apple has since fixed the issue, Anthropic said.
The Android exploit, meanwhile, targeted a locked Google Pixel 9. Claude chained three vulnerabilities in Android’s device-transfer and USB-handling mechanisms, bypassing four layers of protection to extract photos and other personal information from the phone without unlocking it. Anthropic said Google has addressed the issue.
Claude’s Windows exploit, which Microsoft has patched, involved a remotely exploitable denial-of-service (DoS) vulnerability. The flaw was an out-of-bounds read in the Windows kernel’s implementation of the transport protocol used by HTTP/3. An attacker could send a small number of specially crafted network packets to a vulnerable server to crash it and repeatedly trigger crashes, disrupting access for users, Anthropic said.
For Linux, Claude developed a zero-click exploit against the kernel’s networking stack that would have let an unauthenticated remote attacker execute commands with root-level privileges on affected servers, without requiring any user interaction. “This vulnerability (CVE-2026-98432) was patched upstream and backported to all maintained stable kernel branches,” Anthropic said.
Expanding Defender Access to More Powerful Models
With AI getting better at discovering and exploiting vulnerabilities, defenders need powerful models for patching them before attackers can exploit the flaws, Anthropic said. “Enabling defenders with powerful models is critical to giving them a headstart on patching systems before attackers do,” the company said.
To that end, the company is expanding access to its most capable AI models for vetted cybersecurity professionals through its Cyber Verification Program. The program now has three access tiers that give security teams a way to apply for the level of access appropriate for their work.
“It includes access to our most capable models, including Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1, and other new models moving forward,” Anthropic said. “Our advice to defenders remains the same: scanning your own code is more important than ever.”
Andrew Bolster, senior R&D manager at Black Duck, says Anthropic’s results are credible where they can be verified. The Chrome, WebKit, Windows, and Linux fixes are all public, he notes, but any claims that Claude discovered them autonomously are Anthropic’s own. “The report gives no success rates, cost, or human-hours per chain, which is critical context for security leaders,” he says.
Some of the conditions for the exploits to work were also noteworthy, he says. For instance, the Android chain involved a stolen phone and a USB cable, and the Linux exploit required an exposed MPTCP listener. “Exploit benchmarks show model success dropping sharply once ASLR, stack canaries, and sandboxing are enabled, and VulnCheck found only 1.3% of AI-discovered vulnerabilities confirmed exploited in the wild,” Bolster says. “Delivery, reliability, and target preconditions remain the attacker’s problem for now, though I’d expect that gap to narrow.”
Claude’s chained exploits are another indication that AI has lowered the barrier to discovering vulnerabilities and building working attacks, says Jacob Krell, senior director, secure AI solutions and cybersecurity at Suzu Labs. But there are still substantial barriers between a proof of concept and a reliable attack in the wild. “A shell on one honeypot tells you little about the next server’s worker count, build, or kernel,” Krell notes. “AI has made finding the bug cheap. Getting it to work on a server it has never seen is still the expensive part.”
At the same time, the gap between a proof of concept and a reliable, broadly deployable attack is increasingly becoming about time and target-specific adaptation rather than specialized expertise, he cautions.
Defenders are making a mistake if they assume this kind of vulnerability discovery always requires the most powerful AI models, adds John Strand, owner of Black Hills Information Security. “Local systems, including a Mac Studio with 128GB of memory or a DGX Spark, can support AI-assisted reverse engineering and vulnerability research. The target, model, tools, and operator’s skill matter.”
It may take attackers longer, with less capable systems, and attacks may be more practical only against smaller, less-scrutinized code bases. But defenders need to account for that capability, Strand says. “If AI can find vulnerabilities in Windows, Android, Linux, and Chrome, what does that say about code that receives a fraction of that attention? Think about your IP cameras. Think about the firmware on the router running a remote office. All of that is in play.”
