Anthropic Says Internal AI Built Exploit Chains Across Five Platforms

Posted on Oct 28 • Originally published at thedailyflare.com

Originally published on The Daily Flare.

Anthropic says an unreleased internal AI model built five working exploit chains against widely used software, with tests spanning browsers, phones and computer servers; no real-world attacks were reported.

In a research post published October 27, Anthropic’s Frontier Red Team said the model found vulnerabilities in Chrome, Safari, Android, Windows and Linux, then combined separate flaws into proof-of-concept attacks. The company said it disclosed the vulnerabilities to the affected vendors and that fixes are available. Its tests took place in a lab, not in attacks against users.

In Anthropic’s test, the exploit launched the Calculator app on a standard Mac running Chrome within seconds of the page loading, without another user action. The company said its wider Chrome research led to 62 assigned CVEs, all rated critical or high and patched by Chrome 156. That total is Anthropic’s account. Google’s release notes credit Anthropic researcher Xinyang Ge for some fixes, including work assisted by Claude, but do not independently confirm the model’s role in all 62 findings.

The Android demonstration required physical access to a locked phone over USB. Anthropic said its testing included a Google Pixel 9 and that the exploit could bypass restrictions on transferring files from a locked device, allowing photos and other personal data to be copied. The company said Google had addressed the issue, but no public patch record or fixed Android release was identified in The Hacker News report.

The Windows proof of concept was narrower in impact: it could crash a machine over the network and keep it down if repeated. Anthropic described an out-of-bounds read in Windows kernel QUIC handling. The public record for CVE-2026-33096, however, identifies an HTTP.sys denial-of-service flaw. The Hacker News reported that the public record does not tie those descriptions to the same component, and lists no finder. Microsoft’s record credits Anthropic researcher Milad Nasr and Calif.io with Claude, according to TSN. The reported condition was a server answering HTTP/3 requests. The flaw was rated 7.5 out of 10 and was not listed as exploited in the U.S. government’s vulnerability information cited by The Hacker News.

Anthropic described the Linux chain as the most severe of the five: a remote attacker could run commands as root without logging in or taking action on the target computer, provided the server was running a multipath TCP listener. The company said the flaw was patched upstream and backported to maintained stable kernel branches. CVE-2026-98432 was patched on October 15, but the public record does not mention multipath TCP, The Hacker News reported, so that connection relies on Anthropic’s description.

Anthropic said the exploit work followed “initial prompting” and involved little human input. But its post does not identify the internal model or give a step-by-step account of what researchers did during discovery, debugging or exploit construction. That leaves the company’s central claim, that a single model assembled sophisticated multi-stage exploits, dependent on Anthropic’s own description.

The results nonetheless show why security teams are watching AI-assisted vulnerability research. A flaw that is difficult to exploit alone may become more consequential when combined with other weaknesses, as the Chrome and Safari demonstrations illustrate. Anthropic also said it found additional bugs in operating systems and web applications, but did not provide details in the report.

For users and organizations, the immediate point is that the reported demonstrations were proofs of concept and the company says fixes have been made. Keeping browsers, phones and server software updated remains the practical protection identified by the reports.