AI model exploit chains span five major software platforms
AI model exploit chains developed in a laboratory exposed security weaknesses across Chrome, Safari, Android, Windows and Linux. Anthropic says an unreleased internal research model found separate flaws and combined them into five working proof-of-concept exploits, meaning demonstrations that showed the bugs could be used in practice. The company reported the vulnerabilities to the affected vendors, and all five chains are described as patched. There is no evidence that any of them was used in a real attack.
Anthropic's Frontier Red Team says the model required only initial instructions and limited human help, but the company has not disclosed the model's name or documented exactly what people contributed at each stage. Its broader claim, that one AI model could independently assemble several flaws into complete exploits, therefore relies partly on Anthropic's account. Vendor records do independently credit Anthropic and Claude for some Chrome and Apple fixes, although the public Windows record does not identify a finder.
The Chrome chain combined four vulnerabilities. A malicious web page first damaged memory inside V8, Chrome's JavaScript engine. A second flaw escaped V8's memory sandbox, an isolation boundary intended to limit what compromised code can reach, and gained control of the browser component responsible for rendering the page. The chain then used a race condition in CacheStorage, where the result depends on operations occurring in an unexpected order, to reveal the memory layout of a more privileged Chrome process.
A final use-after-free flaw in FedCM, Chrome's sign-in feature, allowed code to escape the browser sandbox completely. A use-after-free occurs when software continues using memory after it should have released it. Anthropic demonstrated the result on a stock Mac: within seconds of a page loading in Chrome, the Calculator application opened without another click. The stated conditions were one click or a page load on stock Chrome for macOS. The fix landed in Chrome 156 on October 20.
Anthropic says it reported 62 Chrome flaws that received CVE identifiers and were fixed by Chrome 156. It described all of them as critical or high severity, including 13 sandbox escapes. Google's release notes credit an Anthropic researcher assisted by Claude for specific fixes, but do not attribute all 62 vulnerabilities that way. For website owners and hosting teams, the immediate lesson is operational rather than theoretical: browsers used to administer sites should be updated promptly because a malicious page could otherwise become a route to code execution on the administrator's computer.
The Safari chain did not execute new code. Instead, it obtained read and write access to browser memory and changed one value to disable the same-origin policy, the browser rule that stops one website from accessing information belonging to another. A malicious page could then read browsing history and cookies or send requests to services where the victim was already signed in, including email or banking sites. Apple fixed the central use-after-free flaw in iOS and iPadOS 26.5.2 on June 29 and credited Anthropic researchers working with Claude. Exploitation required a visit to a malicious page.
The Android chain required physical possession of a locked phone and a USB connection. Anthropic says it could copy photos and other information from a stolen device. The company also says Google fixed the issue, but no corresponding public vulnerability record was found. That makes the reported fix status dependent on Anthropic's description rather than a separately identifiable public advisory.
The Windows chain was a denial-of-service exploit, which makes a system unavailable rather than running code or stealing information. A small number of network packets could crash a server that answered HTTP/3 requests, and repeatedly sending them could keep the machine down. Anthropic described an out-of-bounds read, where software reads beyond the memory area assigned to it, in the Windows kernel's QUIC handling. It linked the chain to CVE-2026-33096, patched in April 2026 and rated 7.5 out of 10.
The public entry for CVE-2026-33096 instead identifies HTTP.sys, Windows' built-in web request handler, and does not name a finder. No open public record connects that component description with Anthropic's account of kernel QUIC handling. As of late October, U.S. government vulnerability enrichment marked the flaw as not exploited, and it was absent from the CISA catalog of known exploited vulnerabilities.
The Linux chain had the highest stated impact because it could execute commands as root, the account with full system control, without a login or user action. It affected servers running a multipath TCP listener, which accepts network connections capable of using more than one path. The exploit first disclosed a kernel memory address to defeat Kernel Address Space Layout Randomization, or KASLR, a defense that hides important memory locations. It then reused the same race-condition bug to redirect execution to attacker-supplied code and obtain a root shell.
Anthropic says its Linux proof of concept needed 48 minutes to disclose the address and another five minutes to reach the root shell. A failed attempt did not crash the target, allowing retries. The company associates the chain with CVE-2026-98432, a use-after-free vulnerability rated 9.8 and fixed upstream on October 15. However, the public CVE description refers to an IPv4 TCP correction rather than multipath TCP, and the connection between the two descriptions is documented only in Anthropic's post.
Anthropic says it followed a coordinated disclosure process that gives developers 90 days to fix reported flaws, followed by 45 additional days before technical details beyond a public advisory are discussed. It also points vetted security professionals to its expanded Cyber Verification Program, which provides access to Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1. The research supports the possibility that AI models can assist with complex exploit development, but the undisclosed model and unspecified human contribution limit independent assessment of how autonomously these chains were produced.
For organisations assessing cross-platform patching, AEU-I provides security-first IT, infrastructure and consulting. Regardless of how the flaws were found, administrators should treat the vendor fixes as the actionable part of the story: update exposed browsers, phones, Windows systems and Linux servers, and verify whether internet-facing services use the affected HTTP/3 or multipath TCP configurations.