Anthropic has published research detailing how one of its unreleased internal models discovered and exploited serious security vulnerabilities in some of the world's most widely used software — including 62 patched vulnerabilities in Google Chrome and a working exploit that gains root access on Linux servers with no user interaction at all.
The findings, laid out in a company research post titled "Discovering and exploiting vulnerabilities in critical, real-world software with Claude," describe five separate attack chains spanning Chrome, Safari, Android, Windows and the Linux kernel. According to Anthropic, the work was carried out by an unreleased, internal research model over the past few months, with each chain leading to remote code execution or other critical impacts with little to no user involvement. As the AI industry digests what this means for software security, AI Buzz Wire continues tracking the latest AI developments as they unfold.
Coordinated disclosure on Anthropic's terms
Anthropic says it reported every vulnerability to the affected vendor under a coordinated vulnerability disclosure policy, which gives developers 90 days to patch and a further 45 days before the company discusses details beyond what is already included in a public advisory. That framing matters: the point of the exercise was not to drop working weapons into the wild, but to demonstrate — with verifiable proof-of-concept exploits — that frontier models can now do security research that was previously the domain of small, highly specialized teams.
"The skills involved have historically been the domain of a few specialist teams," Anthropic's researchers wrote, noting that models can now chain multiple vulnerabilities into a working exploit with little human involvement, then prove it by producing an exploit that anyone can run and verify. The post was authored by Nicholas Carlini, David Dworken, Xinyang Ge, Ben Morris, Milad Nasr, Chris Rohlf and Luna Tong.
Chrome: 62 CVEs, 13 sandbox escapes
The most extensive results came from Google's browser. After an initial prompt, Anthropic's model wrote a full exploit chain that executes arbitrary code outside Chrome's sandbox on a stock, default-configuration macOS machine — the proof-of-concept launches the Calculator app within seconds of a page loading, with no further user interaction.
The chain stepped through four distinct vulnerabilities: a heap corruption bug in the V8 JavaScript engine, a second bug to break out of V8's memory sandbox and defeat ASLR using a return-oriented programming chain, a race condition in CacheStorage used to map the privileged browser process's memory, and finally a use-after-free in Chrome's FedCM federated sign-in feature that allowed code to escape the sandbox entirely.
In total, Anthropic reports that 62 CVEs were assigned and patched as of Chrome 156, all rated critical or high severity, including 13 sandbox escapes and 21 vulnerabilities that could have been used to compromise the renderer process.
Safari, Android and Windows
The Safari chain achieved something arguably more alarming for everyday users: a complete bypass of the same-origin policy, the foundational rule that keeps one website from reading another site's data. The model chained a use-after-free in the JavaScriptCore engine, an escape from WebKit's Gigacage memory isolation, and a flaw in the WebContent sandbox's IPC mechanism — allowing a malicious page to read Safari history and cookies and fire authenticated requests to other domains. Apple, Anthropic notes, acknowledged the report the same day it was submitted and implemented a fix promptly.
On Android, the model combined source-code analysis, reverse engineering of Google Play services binaries, and live testing on a physical Google Pixel 9 to build an exploit that extracts photos and personal data from a locked phone over USB — bypassing the pairing authorization flow and the six-digit code verification step along the way.
The Windows finding was a remote, unauthenticated crash: an out-of-bounds read in the Windows kernel's QUIC implementation, now tracked as CVE-2026-33096 and fixed by Microsoft. Anthropic estimates several million servers respond to HTTP/3 and could have been crashed repeatedly by the exploit. Notably, the company says the model found the bug through pure binary analysis — reverse-engineering the Windows executable with tools like Ghidra before studying the reconstructed code for weaknesses.
The Linux kernel: zero-click root
The fifth chain is the one security teams are likely to lose sleep over. Anthropic's model discovered a race condition-induced use-after-free in the Linux kernel's networking stack, tracked as CVE-2026-98432, and built an exploit that sends network packets to any server running a multipath TCP (MPTCP) listener to execute arbitrary commands as root — no credentials, no user interaction.
The exploit works in two stages: first it defeats KASLR remotely by abusing the race to trigger an overread that leaks a kernel pointer back to the attacker; then it overflows a buffer to overwrite a callback pointer, chaining existing kernel functions until an attacker-chosen shell command runs as root. In Anthropic's proof of concept, leaking a kernel pointer took 48 minutes, with shell access roughly five minutes later. A key enabling property: losing the race merely fails the handshake without crashing the system, so an attacker can retry indefinitely.
Anthropic says the vulnerability was patched upstream and backported to all maintained stable kernel branches. Distribution rollouts have lagged, however — The Hacker News reported this week that Ubuntu and Red Hat had no fixed kernel available yet, and the Go project issued an advisory warning that Go programs enable multipath TCP by default, exposing them to the flaw.
A new baseline for attackers — and defenders
Beyond the individual bugs, Anthropic's post describes the methodology that made the scale possible: a platform running large numbers of scanning agents in parallel, measuring how many additional vulnerabilities each scanner contributes, and applying automated variant analysis to every confirmed finding. The company also recommends scanning at pull-request time and has released a Claude Code security plugin publicly for that purpose.
For defenders, Anthropic is expanding its Cyber Verification Program, which gives qualifying security professionals access to advanced cyber capabilities and its most capable models, including Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1. The company's advice remains blunt: scan your own code before someone else's model does.
The episode is a vivid data point in an ongoing debate about AI and cyber offense. Frontier labs have spent two years arguing that models could soon find and chain real-world vulnerabilities — this week, at least, the burden of proof has been met with working exploits.
For continuous coverage of AI security research, model releases and policy, follow AI Buzz Wire.
