Anthropic says internal AI model built five working exploit chains across browsers, phones and servers

Anthropic's Frontier Red Team says an unreleased internal AI model assembled five working exploit chains against widely used software, in research published October 27 and reported by The Daily Flare. The chains covered browsers, phones and servers — Chrome, Safari, Android, Windows and Linux — and were all demonstrated in a lab. Anthropic says it disclosed the vulnerabilities to the affected vendors, that fixes are available, and no attacks on real users have been reported.

What the model reportedly built

The Chrome demonstration is the most detailed. According to Anthropic, the model linked four separate flaws into one attack: a bug in Chrome's V8 JavaScript engine, a second flaw that escaped V8's memory protections, a CacheStorage race condition that leaked information about browser memory, and a use-after-free flaw in the FedCM sign-in feature. The finished chain broke out of Chrome's security sandbox on a standard Mac and launched the Calculator app within seconds of a malicious page loading, without any further action by the user.

The Safari chain had a different objective: bypassing the same-origin policy, the browser safeguard that normally stops one site from reading another site's data. Anthropic said the proof of concept could read information such as cookies and browsing history and send authenticated requests to other sites. Apple credited Milad Nasr and Nicholas Carlini, who worked with Claude at Anthropic, for a related fix in iOS and iPadOS 26.5.2, according to The Hacker News.

The phone and server chains

The Android test required physical access to a locked phone over USB. Tested on a Google Pixel 9, the exploit reportedly bypassed the restrictions that normally block file transfers from a locked device, allowing photos and other personal data to be copied. Anthropic said Google has addressed the issue, but The Hacker News found no public patch record or fixed Android release confirming it.

The Windows proof of concept was the least damaging of the five: it could crash a machine over the network and keep it down if repeated. Anthropic attributed it to an out-of-bounds read in Windows kernel QUIC handling, but the public record for CVE-2026-33096 describes an HTTP.sys denial-of-service flaw instead. The Hacker News noted that the public record does not tie the two descriptions to the same component and lists no finder. Microsoft's entry credits Milad Nasr and Calif.io with Claude, according to TSN, and the condition involved a server answering HTTP/3 requests. The flaw scored 7.5 out of 10 and is not listed as exploited in the U.S. government vulnerability data cited by The Hacker News.

Anthropic described the Linux chain as the most severe of the set. A remote attacker could run commands as root without logging in and without any action on the target machine, provided the server was running a multipath TCP listener. The company said the flaw was patched upstream and backported to maintained stable kernel branches. However, CVE-2026-98432, which was patched on October 15, does not mention multipath TCP in its public record, so connecting it to Anthropic's demonstration rests on the company's own description, The Hacker News reported.

How much rests on Anthropic's word

Parts of the announcement are hard to verify independently. Anthropic said its wider Chrome research led to 62 assigned CVEs, all rated critical or high and patched by Chrome 156. Google's release notes credit Anthropic researcher Xinyang Ge for some of those fixes, including work assisted by Claude, but do not confirm the model's role in all 62 findings.

More broadly, Anthropic says the exploit work followed only "initial prompting" and involved little human input, yet it does not identify the internal model or describe step by step what researchers did during discovery, debugging or exploit construction. As The Daily Flare observes, the central claim — that a single model assembled sophisticated multi-stage exploits — depends on Anthropic's own description. The company also said it found additional bugs in operating systems and web applications but provided no details.

Why it matters

The report speaks directly to the debate over whether AI raises offensive cyber risk. Its sharpest lesson is composability: flaws that look manageable in isolation become far more dangerous when combined, and the Chrome and Safari chains show what such combinations achieve — a sandbox escape and a same-origin policy bypass triggered by nothing more than loading a web page. If Anthropic's account holds, the practical distance between finding bugs and weaponizing them is shorter than many assumed.

The verification gaps matter too. Public CVE records and vendor notes only partially corroborate the story, and the undisclosed role of human researchers leaves the model's true contribution unclear. For defenders, the immediate response is straightforward: every demonstration was a proof of concept, patches reportedly exist, and keeping browsers, phones and server software current remains the practical protection the reports point to.