Anthropic's AI chains critical vulnerabilities in Chrome, Safari, and Linux

An internal model breaches security barriers in critical software

Anthropic has published a technical report detailing how one of its research models, not yet commercially available, identified critical vulnerabilities in some of the world's most widely used programs. The work, conducted over several months, focused on browsers like Chrome and Safari, as well as operating systems such as Windows, Linux, and Android.

The novelty lies not only in finding individual errors but in the model's ability to chain multiple weaknesses into a coherent sequence resulting in a functional exploit. Historically, this type of offensive engineering required teams of specialists with years of experience; the report suggests that AI models can now perform this work with minimal human intervention.

Five attack chains: from Chrome to the Linux kernel

The report describes five specific attack scenarios. In the case of Chrome, the model built a chain enabling remote code execution with a single click. This was achieved by combining memory errors in the V8 JavaScript engine, a race condition in CacheStorage, and a use-after-free flaw in the Federated Credential Manager (FedCM) component.

For Safari, the AI developed an exploit that bypassed the Same-Origin Policy (SOP), allowing a website to access the user's history, cookies, and session data without executing arbitrary code. On Android, the model extracted photos from a locked phone by bypassing USB data transfer restrictions and pairing verification.

The Linux case: code execution without interaction

The most severe finding occurred in the Linux kernel. The model identified a race condition in the network stack that allowed a remote attacker to execute commands with root privileges without credentials or user interaction. This vulnerability, associated with CVE-2026-98432, affected servers with the Multipath TCP (MPTCP) protocol active.

Exploitation occurred in two phases: first, the attacker leaked the kernel's address space layout to bypass randomization protections (KASLR); second, it leveraged the flaw to overwrite a callback pointer and execute a malicious payload. In proof-of-concept tests, this process took approximately 53 minutes from start to command execution.

Methodology: reverse engineering and automated analysis

Anthropic explains that the process was not a simple automated scan. In the Windows case, the team provided the model with a copy of the binary and asked it to perform reverse engineering using tools like Ghidra. The model had to write an annotated C program to reproduce the software's behavior and compare it with the original binary to identify security deviations.

Anthropic's platform runs multiple scanning agents in parallel, measuring each one's unique contribution and dynamically adjusting coverage. This approach allows the model not only to find vulnerabilities but also to analyze variants and classify the risk of each finding before reporting it.

Implications for defense and the industry

The ability of AI models to generate sophisticated exploits shifts the balance in cybersecurity. While attackers have not yet demonstrated large-scale use of these tools, the reduction in the barrier to entry for offensive engineering is significant. Defenders now face the possibility that complex vulnerabilities will be discovered and exploited more rapidly.

Anthropic argues that the solution is not to restrict access to these capabilities but to expand access for security professionals. The company has expanded its Cyber Verification Program to allow qualified defenders to use its most advanced models to audit their own code and patch systems before attackers do.

Keep exploring

Corrections and transparency

If you spot incorrect or outdated information, send us a correction with the page and source we should review.