Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits

The exploits were developed in Anthropic's lab after prompting the AI model, not observed in real attacks. The company reported all vulnerabilities to vendors first, ensuring patches were in place before disclosure. One particularly striking proof of concept opened the Calculator app on a stock Mac running Chrome within seconds of a page loading, requiring no further user interaction.

Complex Vulnerability Chains

Anthropic's Frontier Red Team documented five distinct exploit chains in their research. The most significant achievement wasn't discovering individual bugs, but rather demonstrating that a single AI model could identify multiple separate flaws and combine them into functional exploits—a capability previously limited to specialized security teams.

The Chrome chain involved four separate vulnerabilities working in sequence: first corrupting memory in V8, Chrome's JavaScript engine; then escaping the memory sandbox to control page rendering; exploiting a race condition in CacheStorage to access privileged memory; and finally using a use-after-free bug in FedCM to run code outside the sandbox. Anthropic reported 62 flaws to Google, all assigned CVEs and fixed in Chrome 156, with 13 being sandbox escapes.

Now, it's something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify.

Platform-Specific Exploits

The Safari exploit chain differs fundamentally as it never executes code. Instead, it chains vulnerabilities to gain full read and write access to browser memory, then modifies a single value to disable the same-origin policy. This would allow malicious pages to read user history and cookies and make signed-in requests to other sites. Apple fixed the critical use-after-free vulnerability in iOS and iPadOS 26.5.2.

The Windows chain represents the most limited impact—a denial-of-service attack that crashes the machine with repeated network packets. Anthropic describes it as an out-of-bounds read in the Windows kernel's QUIC handling, though the public CVE record references HTTP.sys instead. The Linux chain proves most serious, enabling remote command execution as root on multipath TCP listeners, though the public CVE description differs from Anthropic's account.

Security Implications

While vendors have verified the patches and credited Anthropic researchers for specific fixes, the extent of the AI model's independent contribution remains unclear. Anthropic states the work required only "initial prompting" and "little human involvement" but provides detailed breakdown of human intervention at each step.

The company emphasizes following coordinated disclosure policies, giving developers 90 days to patch vulnerabilities before discussing details publicly. Anthropic has expanded its Cyber Verification Program to provide vetted professionals with access to Claude Opus 5.5, Sonnet 5.5, and Mythos 5.1 models to enhance security research capabilities.