An unreleased Anthropic AI model just did something that used to take elite human hacking teams months to pull off, because the company says the model found separate security flaws across five major platforms and chained them into working proof-of-concept exploits.

The exploits were built in a lab, not seen in the wild, and Anthropic reported every flaw to the vendors first, so all of them are already patched. But the sheer capability on display here is a massive wake-up call for defenders.

One proof of concept opened the Calculator app on a stock Mac running Chrome within seconds of a page loading, with zero clicks required.

The Capability Claim and the Evidence Gap

The strongest claim here isn't any single bug, it's that one model found several separate flaws and combined them into a working exploit. Anthropic says this has until now been the work of a few specialist teams.

However, you have to read this with a critical eye. The patches and the fact that Apple and Google credit Anthropic and its Claude model for specific fixes can be verified with the vendors. But what a reader cannot check is how much of each chain the model built on its own. Anthropic says the work needed only "initial prompting" and "little human involvement," but it does not break down what a person did at each step.

For the one flaw with its own public record (the Windows bug), the record names no finder at all. So, while the fixes are real, Anthropic's authorship of every single step rests largely on its own word.

The Five Exploit Chains

Here is exactly what the AI model found, what each chain does, the conditions required, and where the fix landed.

The Chrome Chain: Sandbox Escape

In the Chrome chain, the model used four separate flaws in sequence. A malicious page first corrupted memory in V8, Chrome's JavaScript engine. A second flaw escaped V8's memory sandbox and took control of the rendering process. A race condition in CacheStorage then let that code read memory and learn the layout of the more privileged browser process. Finally, a use-after-free bug in FedCM let the exploit run code outside the sandbox entirely.

Anthropic says it reported 62 flaws to Google that were assigned CVEs and fixed as of Chrome 156, including 13 sandbox escapes. Google's release notes credit "Xinyang Ge of Anthropic, assisted by Claude" for specific Chrome fixes, though not for all 62.

The Safari Chain: Same-Origin Bypass

The Safari chain never runs code at all. It chains flaws to obtain full read and write access to the browser's memory, then changes a single value to turn off the same-origin policy. With that rule off, a malicious page can read a user's history and cookies and send signed-in requests to other sites. Apple fixed the central use-after-free bug in iOS and iPadOS 26.5.2 and credits "Milad Nasr and Nicholas Carlini with Claude, Anthropic" for it.

The Linux Chain: Root Over the Network

The Linux chain is the most serious in terms of impact, because it runs commands as root over the network without a login. It needs the target server to be running a multipath TCP listener. The model first leaks a kernel memory address to bypass KASLR, then reuses the same race-condition bug to redirect the program to code the attacker has already placed, resulting in a root shell.

Anthropic says its proof of concept took 48 minutes to leak the address and five more to reach the shell.

The CVE Record Discrepancies

Here is where things get a bit messy. Anthropic ties the Windows chain to CVE-2026-33096, an out-of-bounds read in the Windows kernel's QUIC handling. But the public record for that CVE names HTTP.sys (Windows' built-in web request handler) and rates it 7.5 out of 10. No open source ties those two descriptions together as the same component.

Similarly, for the Linux chain, Anthropic ties it to CVE-2026-98432, a kernel use-after-free rated 9.8. However, the public record for that CVE describes an IPv4 TCP fix rather than a multipath TCP one. The two are linked only by Anthropic's post.

This doesn't mean Anthropic is lying, but it does highlight the friction between AI-generated research and traditional CVE database management.

What This Means for Defenders

Anthropic frames this work as help for defenders, noting it reported each flaw under a coordinated disclosure policy that gives developers 90 days to patch. The company also points security teams to its expanded Cyber Verification Program.

But the real takeaway is the shift in the threat landscape.

• AI is now a chaining engine: Finding one bug is hard. Finding four bugs and combining them into a working exploit is what makes elite researchers elite. If AI can do this in a lab, it will eventually do it in the wild.
• Patch speed matters more than ever: With AI able to scan massive codebases and find vulnerabilities faster than human teams, your patch management window is shrinking.
• Public records are lagging: If AI-discovered flaws don't map cleanly to public CVE databases, your vulnerability scanners might not flag them properly.

FAQ

Did this AI model actually hack real systems?

No. Anthropic says the exploits were built in a lab after the model was prompted. They were not seen in any real attack, and every flaw was reported to the vendors and patched before publication.

How many flaws did the AI find in Chrome?

Anthropic says it reported 62 flaws to Google that were assigned CVEs, including 13 sandbox escapes. Google's release notes credit Anthropic and Claude for specific fixes, but not for all 62.

Can the AI really bypass the Chrome sandbox?

Yes, in the lab. The model chained four separate bugs (V8 corruption, a sandbox escape, a CacheStorage race condition, and a FedCM use-after-free) to run code outside the sandbox on a stock Mac.

What is the most dangerous exploit chain?

In terms of raw impact, the Linux chain is the worst. It allows an attacker to run commands as root over the network with no login required, provided the server is running a multipath TCP listener.

Why don't the CVE records match Anthropic's description?

That is unclear. For the Windows and Linux bugs, Anthropic's descriptions of the vulnerabilities don't match the official CVE records. This could be a miscommunication, a naming difference, or a lag in updating the databases.

Source: The Hacker News