Anthropic AI Model Chains Vulnerabilities Into Functional Exploits
Unreleased AI model autonomously identifies and chains software flaws across major operating systems.
1Autonomous Exploit Generation
Anthropic researchers utilized an unreleased AI model to identify and chain multiple security vulnerabilities across Chrome, Safari, Windows, and Linux. The model successfully created proof-of-concept exploits in a lab environment. These findings demonstrate that AI can now perform complex security research tasks previously requiring teams of specialized human experts.
2Chrome Sandbox Escape
The model chained four distinct flaws within Chrome to achieve code execution outside the browser sandbox. It corrupted memory in the V8 engine, escaped the sandbox, and exploited a race condition in CacheStorage. A final use-after-free bug in the FedCM feature allowed the model to execute arbitrary code on the host.
3Safari Policy Bypass
In the Safari exploit chain, the model bypassed the same-origin policy without executing external code. By obtaining read and write access to browser memory, it modified a single value to disable security restrictions. This allowed the model to access user history and cookies, effectively compromising the browser's core data protection mechanisms.
4Linux Root Access
The Linux exploit chain represents the most severe impact, granting root-level command execution over a network. The model bypassed KASLR defenses by leaking kernel memory addresses and utilized a race-condition bug to redirect program flow. The entire process took approximately 53 minutes to achieve a functional root shell on target servers.
5Windows Kernel Vulnerability
The Windows chain focused on a denial-of-service attack targeting the kernel's QUIC handling. By sending specific network packets, the model could crash the machine repeatedly. While Anthropic links this to CVE-2026-33096, public records associate the flaw with HTTP.sys, highlighting discrepancies between internal research findings and existing public vulnerability documentation.
6Coordinated Disclosure Process
Anthropic followed a strict coordinated disclosure policy, reporting all 62 identified flaws to vendors before public release. This allowed Google and Apple to issue patches for critical and high-severity bugs. The company emphasizes that these exploits were created in a controlled lab setting and were not observed in any real-world attacks.
7Human-AI Collaboration Limits
While Anthropic claims the model required only initial prompting and minimal human involvement, the exact division of labor remains opaque. The company has not provided a detailed breakdown of human intervention steps. Furthermore, the specific internal research model used for these exploits remains unnamed, limiting independent verification of the model's autonomous capabilities.
8Strategic Security Implications
This research signals a shift where AI models can autonomously prove the severity of chained vulnerabilities. By providing vetted professionals access to models like Claude Opus 5.5, Anthropic aims to assist defenders in closing identity and security gaps. The ability to verify exploits automatically changes how security teams assess their attack surface readiness.