Do Son 
Anthropic has revealed what its AI vulnerability research can do against hardened, real-world software. Over several months, an unreleased internal model found critical flaws in browsers and operating systems. In fact, the company detailed five attack chains that led to remote code execution and other serious impacts.
In its report on discovering vulnerabilities with Claude, Anthropic says the targets were chosen for a reason. “Any vulnerabilities in these products could affect billions of users,” the company wrote.
Five Attack Chains, Five Platforms
First, Claude built a one-click exploit chain in Chrome that escaped the browser sandbox. Google has since patched 62 CVEs from this work, all rated critical or high.
Second, a Safari chain bypassed the same-origin policy. Notably, it never needed code execution. Anthropic calls it “a data-only attack that never relies on arbitrary code execution.” Apple fixed the issue promptly.
Third, Claude found a way to pull photos from a locked Android phone. Google has addressed the bug.
Fourth, a flaw in the Windows kernel’s QUIC code let attackers crash servers remotely. Microsoft fixed it as CVE-2026-33096. Anthropic estimates “there are likely several million such servers listening on the internet.”
Finally, Claude found a zero-click remote code execution bug in the Linux kernel. It affects servers with a multipath TCP listener. This flaw, CVE-2026-98432, has been patched and backported to all stable branches.
Responsible Disclosure
Anthropic reported every flaw under coordinated disclosure. Vendors get “90 days to patch and a further 45 days” before more details come out. As a result, all five chains are now fixed. This careful process lets AI vulnerability research help vendors instead of attackers.
Why It Matters
Overall, this AI vulnerability research marks a clear shift. Anthropic says the work shows the model can “create sophisticated, multi-step exploits in both open-source and proprietary software.” For defenders, the message is simple. Patch Chrome, Safari, Android, Windows, and Linux systems quickly, because AI is speeding up bug discovery on both sides.
Support Our Threat Intelligence
Find our tech and OS security coverage helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
