AI security company Anthropic released a report revealing that its internal Claude model identified numerous critical vulnerabilities across five major systems—Chrome, Safari, Android, Windows, and Linux—and autonomously constructed five fully functional attack chains. These encompass end-to-end risks including sandbox escapes, same-origin policy bypasses, lock screen data extraction, and kernel-level remote code execution. All identified vulnerabilities have been submitted and resolved through coordinated disclosure procedures, highlighting the significant potential and critical security implications of large models in automated offense and defense.Author and source: AIBase
Recently, AI safety company Anthropic officially released a major research report. The report reveals that one of its undisclosed internal Claude research models successfully identified numerous vulnerabilities across five major operating systems and browsers—Chrome, Safari, Android, Windows, and Linux—and autonomously chained them into five practical, high-severity attack chains. All identified vulnerabilities have been reported to the respective vendors through coordinated disclosure processes and have since been patched.
In the highly anticipated Chrome browser, Anthropic’s report identified a total of 62 critical or high-severity vulnerabilities, including 13 sandbox escapes and 21 vulnerabilities enabling control over web rendering processes; corresponding fixes have been officially released in Chrome 156. The research team noted that, after receiving an initial prompt, Claude was able to autonomously locate vulnerabilities and generate exploit code—its proof-of-concept (PoC) even triggered the Calculator app within seconds of page loading, on a default macOS installation.
On Apple's Safari browser, the model constructed a "one-click" attack chain that successfully bypassed the same-origin policy, allowing malicious websites to access sensitive private data—such as browser history, cookies, and logged-in emails or bank accounts—that should have been strictly isolated. Apple confirmed the vulnerability and released a patch on the same day.
For Android on mobile devices, penetration testing has shown that, under the condition of physical access to the device, this vulnerability chain can directly extract personal local data such as photos from a Pixel 9 phone that is locked or locked-screen, by exploiting USB-related flaws. Google has stated that this issue has been addressed.
On both desktop and server platforms, Windows and Linux were equally affected. On Windows, Claude discovered a critical vulnerability (scored 7.5) designated as CVE-2026-33096, allowing attackers to repeatedly crash servers responding to HTTP/3 requests without any authentication or user interaction; Microsoft released a patch for this in April 2026. On Linux, Claude identified a zero-click remote code execution vulnerability (CVE-2026-98432) in the network stack targeting servers running multipath TCP listeners; the research team successfully exploited the vulnerability in just 53 minutes—48 minutes to leak kernel pointers and only 5 minutes to gain root shell access.
Overall, these five linked attack chains cover the full spectrum of risks, from V8 engine sandbox escape and same-origin policy bypass to hardware interface data extraction and kernel-level remote code execution. Industry experts note that this research not only demonstrates the exceptional upper limit of cutting-edge large models in automated vulnerability discovery and offensive-defensive confrontation but also serves as a wake-up call for security defenses in mainstream software ecosystems.