Anthropic Says Unreleased Claude Model Built Working Exploit Chains Against Browsers and Operating Systems

Anthropic says it has spent the past few months using an unreleased, internal research model to find critical vulnerabilities in some of the world's most widely used software, including browsers and operating systems. It shared details of five attack chains that led to remote code execution and other critical impacts with little to no user interaction. The company says this shows the model can build sophisticated, multi-step exploits in both open-source and proprietary software.

Two examples are described. In Google Chrome on macOS, Claude wrote a full exploit chain that let an attacker run arbitrary code as the user, outside the browser's sandbox, after initial prompting. Google has since patched 62 CVEs as of Chrome 156, all rated critical or high severity. These include 13 sandbox escapes and 21 flaws that could have been used to compromise the renderer. In Safari, Claude wrote an exploit chain that let any website's JavaScript bypass the same-origin policy. That could expose browsing history, cookies and other sensitive data, and allow authenticated requests to other sites, such as reading email or viewing bank balances for a signed-in user.

Anthropic reported every vulnerability to the affected vendor under coordinated disclosure. Developers get 90 days to patch, plus a further 45 days before Anthropic discusses details beyond the public advisory. The company notes that flaws in these products could affect billions of users, which makes them a useful test of AI vulnerability research capability.