Anthropic's unreleased AI built working hacks for Chrome, Safari and more

An unreleased AI model from Anthropic found security flaws in Chrome, Safari, Android, Windows and Linux, then linked them into working attacks, the company says. The attacks were built in a lab and have not been seen in real use. Anthropic reported every flaw to the software maker first, so all of them are already patched.

What Anthropic says it did

Anthropic's Frontier Red Team described five attack chains. A chain links several separate flaws so that together they do more than any one could. The company says the model needed only "initial prompting" and "little human involvement." It says this kind of work has until now been done by a few specialist teams. That claim rests on Anthropic's own account.

In one test, the Calculator app opened on a stock Mac running Chrome within seconds of a web page loading, with no further clicks.

The chains in brief

• Chrome: four flaws used in turn, ending with code running outside the browser's protective sandbox.
• Safari: full access to browser memory, then the rule that stops one site reading another's data is switched off.
• Windows: a few network packets crash a machine. It does not run code or steal data.
• Linux: runs commands as root over a network with no login, if the server runs a multipath TCP listener. It took about 53 minutes.

For Chrome, Anthropic says it reported 62 flaws to Google, all rated critical or high and fixed as of Chrome 156. Thirteen were sandbox escapes. Google's release notes credit "Xinyang Ge of Anthropic, assisted by Claude" for specific fixes, though not all 62.

What is not clear

Nobody outside Anthropic can check how much of each chain the model built alone. The company does not say what a person did at each step. It also does not name the model beyond calling it an unreleased internal research model.

Two links also rest only on Anthropic's post. The Windows bug, CVE-2026-33096, is rated 7.5 out of 10 and names a different component than Anthropic describes. It credits no finder. The Linux bug, CVE-2026-98432, is rated 9.8 and was fixed upstream on October 15. Its public record describes a different fix. As of late October, the Windows flaw was not marked as exploited.

What to do

The fixes exist, so the practical step is to keep your browser, phone and computer updated. The worry is speed. AI may shorten the time it takes an attacker to turn a flaw into a working attack. Anthropic says it gives developers 90 days to patch, plus 45 more before sharing details, and offers vetted security professionals wider access through its Cyber Verification Program.