Anthropic's internal Claude research model found and chained real-world exploits in Chrome, Safari, Android, Windows, and Linux
Anthropic's Frontier Red Team used an unreleased Claude model to discover five critical exploit chains. All were patched before disclosure.
Anthropic’s Frontier Red Team has published details of five real attack chains produced by an unreleased internal Claude research model. The targets were not obscure enterprise software. They were Chrome, Safari, Android, Windows, and Linux. The findings were reported to each vendor under coordinated disclosure, and patches were in place before Anthropic published a word publicly.
This is a meaningful moment, and it is worth taking a few minutes to understand what actually happened.
What the model found
The team published details of five separate campaigns. Each one found vulnerabilities and chained them together into a working exploit, which is the hard part that separates a bug report from an actual attack.
Chrome: one-click remote code execution. Claude produced a four-bug chain that executes arbitrary code on a user’s machine without any interaction beyond clicking a link. The proof of concept launched the Calculator app from a default Chrome installation on macOS within seconds of a page loading. The chain started with a V8 heap memory corruption bug, added a second flaw to break out of V8’s memory sandbox and defeat address space layout randomisation, then exploited a race condition in CacheStorage to read the memory layout of the privileged browser process. A use-after-free bug in FedCM, Chrome’s sign-in feature, completed the sandbox escape. Google assigned 62 CVEs across the full campaign, all rated high or critical, including 13 sandbox escapes. All are fixed in Chrome 156. Google’s own release notes credit “Xinyang Ge of Anthropic, assisted by Claude” for specific fixes.
Safari: same-origin policy bypass. The Safari chain never needed to execute code at all. It chained a use-after-free bug in JavaScriptCore with a bypass of WebKit’s Gigacage memory defence, then used a flaw in the sandbox’s IPC mechanism to read history, cookies, and session data from disk. A hostile page running this chain could silently read a signed-in email inbox or banking session. Apple has patched the chain.
Android: lock-screen bypass. This one requires physical access to a device. Claude found a way to extract photos and other data from a locked Google Pixel 9 over USB. Google has addressed the issue.
Windows: remote denial of service. An attacker could reach the vulnerable code path remotely over the network and send a small number of packets to a listening server to crash and restart the machine. A patch and CVE are in place.
Linux: unauthenticated remote root access. Under specific conditions, the model found a path to unauthenticated remote root access. That is about as bad as a single-bug finding gets. A CVE and patch are published.
What is actually new here
Finding a single bug in a major browser is something specialist security researchers do. Chaining multiple bugs together into a working, reliable exploit is considerably harder, and until now it has been the work of a small number of specialist teams, typically with years of platform-specific experience.
What Anthropic is claiming is that one internal model did this across five different software ecosystems in a matter of months. That is the part worth sitting with.
The model used for this work is not Claude 3.5 Sonnet or any publicly available version. It is an unreleased internal research model. Anthropic did not release it, citing specifically its ability to find software vulnerabilities. This is itself a signal about where capability is heading, separate from any individual finding.
This work sits alongside Anthropic’s broader Project Glasswing initiative, which uses a preview version of its frontier model, Claude Mythos, to find and address security vulnerabilities at scale. The Frontier Red Team research described here used a different, earlier internal model, but both programmes reflect the same underlying view: AI models can now find high-severity vulnerabilities systematically, and the question is whether defenders or attackers will benefit most from that capability.
What this means for you
If you use Chrome, Safari, Android, or Windows: the specific vulnerabilities described here are patched. Update your software if you have not done so since Chrome 156 shipped. For most people reading this, automatic updates will have handled it already, but it is worth checking.
If you work in security: the disclosure policy Anthropic used is worth understanding. Vendors received 90 days to patch, with an additional 45 days before Anthropic discussed detail beyond a public advisory. That is a reasonable and generous timeline by industry standards, and it is the framework Anthropic says it will apply to future findings.
If you are responsible for software or infrastructure: the Linux finding in particular is a reminder that “specific conditions” for an exploit are not the same as “impossible conditions”. Review your exposure to remotely reachable services running as root, and treat kernel and OS updates with the same urgency you apply to browser patches.
If you are thinking about AI capability more broadly: Anthropic’s framing is explicitly defensive. The argument is that attackers will gain access to models with these capabilities regardless, and the window to use AI to find and fix vulnerabilities at scale, before that happens widely, is open right now but will not stay open indefinitely. That framing may or may not prove correct, but it is the reasoning behind publishing this research rather than keeping it internal.
The coordinated disclosure detail matters
It would be easy to read a headline about an AI finding Chrome exploits and assume something alarming happened. The sequence here was the opposite of alarming: vulnerabilities were found, reported privately, patched by the vendor, and only then disclosed publicly. Apple and Google have both acknowledged specific findings in their own release notes, which independently corroborates at least part of what Anthropic is claiming.
There are some unresolved questions. Independent researchers have noted discrepancies between Anthropic’s descriptions of the Windows and Linux findings and the corresponding public CVE records. The model’s precise contribution to each exploit chain is also difficult to verify externally. These are fair caveats, and they do not undermine the core finding, but they are worth knowing about if you are doing deeper technical due diligence.
The full research post is worth reading if you want the technical detail. The coordinated disclosure policy is published at red.anthropic.com.