Anthropic's AI model found and exploited flaws in Chrome, Safari, Windows and Linux

How the flaw works

According to The Hacker News↗ (opens in a new tab), an unreleased AI model from Anthropic was able to find and combine security flaws in Chrome, Safari, Windows and Linux. The model, when prompted, produced working proof-of-concept exploits in a lab setting. These were not seen in real-world attacks. Anthropic says it reported every flaw to the relevant vendor before any public disclosure, and all have been patched.

For Chrome, the model found a chain of vulnerabilities: it escaped the V8 JavaScript sandbox, used a race condition in CacheStorage to read privileged memory, and finally exploited a use-after-free bug in the FedCM sign-in feature to run code outside the browser's security sandbox. Anthropic reported 62 flaws to Google, all fixed as of Chrome 156, with 13 allowing sandbox escapes. Google's release notes credit Anthropic's team for some of these fixes.

The Safari exploit worked differently. Instead of running code, it chained flaws to gain full access to browser memory and disabled the same-origin policy, a key browser defence that prevents one website from reading another site's data. With this protection off, a malicious page could access a user's browsing history, cookies and send requests as if it were the user. Apple fixed the core flaw in iOS and iPadOS 26.5.2 and credited Anthropic's team.

The Windows exploit was a denial-of-service attack. The model found a way to crash a server over the network and keep it offline by repeating the attack. Anthropic links this to CVE-2026-33096, an out-of-bounds read in HTTP.sys, Windows' web request handler, rated 7.5 out of 10 in severity. There is no public confirmation tying Anthropic to this CVE beyond its own post, and the U.S. government had not listed it as exploited as of late October.

On Linux, the model found a chain that allowed it to run commands as root (the highest privilege) over the network, with no login required. The attack needed the target server to be running a multipath TCP listener. The model leaked a kernel memory address to bypass KASLR (a defence that randomises memory locations), then used a race condition to redirect execution to attacker-controlled code, resulting in a root shell. Anthropic links this to CVE-2026-98432, rated 9.8, but the public CVE record describes a different TCP issue, and the link relies on Anthropic's own report.

The response

Anthropic says it followed a coordinated disclosure policy, giving vendors 90 days to patch and 45 more before sharing technical details. Google and Apple have publicly credited Anthropic for some fixes. The company says its goal is to help defenders, not attackers, and it has expanded its Cyber Verification Program to give vetted security professionals access to its AI models for research.

What experts say

Anthropic's own statement says: "Now, it's something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify." This highlights the growing capability of large language models to automate complex security research tasks, including chaining multiple flaws into a working attack.

What you should do

All the flaws found by Anthropic's AI have been patched in the latest versions of Chrome, Safari, Windows and Linux. Users and administrators should make sure their systems are up to date. Security teams should be aware that AI tools can now automate the discovery and exploitation of vulnerabilities, raising the bar for both attackers and defenders.

Only one outlet has reported these findings so far, and some links between Anthropic's research and public CVE records rely solely on Anthropic's own statements. There is no public evidence that these exploits have been used in real attacks.