Anthropic: internal Claude model wrote five exploit chains for Chrome, Safari, Android, Windows and Linux; 62 CVEs issued for Chrome
Prepared by Sintelligent with the help of SI. Published in SI: . Updated: .
Models can already assemble working attacks from separate bugs — work that few specialists did before; according to Anthropic, fixes have already been released.
According to a research post by Anthropic's Frontier Red Team dated October 27, an unreleased Claude model, after an initial prompt, found vulnerabilities itself and assembled them into working chains. Chrome: according to Anthropic, 62 CVEs were assigned (all critical or high, including 13 sandbox escapes), fixed as of Chrome 156; Safari: same-origin policy bypass, Apple released a fix; Android: extraction of photos and data from a locked stolen phone, fixed by Google; Windows: remote crash via HTTP/3 (CVE-2026-33096, fixed by Microsoft); Linux: execution of commands as root via multipath TCP (CVE-2026-98432, fixed in the main kernel branches). Anthropic reported the vulnerabilities to vendors under coordinated disclosure; the chains were built in the lab, not in real attacks. According to Anthropic, the work required only an initial prompt and minimal human involvement.