Anthropic says its internal Claude research model targeted Chrome, Android, Windows and…

Anthropic’s Frontier Red Team reports that an unreleased internal Claude research model generated complete, multi-step exploit chains for five widely used software targets after initial prompting. These included one-click code execution outside the Chrome sandbox and zero-click remote root access to Linux servers. Anthropic reported all the issues to the respective vendors. The post describes only vulnerabilities that have since been resolved.

Each exploit chain combined several separate vulnerabilities. Anthropic says the model identified the individual flaws and linked them to create the exploits. The following sections explain how each attack worked.

Chrome: Code execution outside the sandbox

The proof of concept (PoC) opens the Calculator app on a Mac running the default configuration of Chrome within seconds of a webpage loading, without requiring any further user interaction. The exploit used four stages, each involving a separate vulnerability identified by the model:

V8 heap corruption: A flaw in Chrome’s JavaScript engine allowed a malicious webpage to corrupt V8’s heap memory.

V8 sandbox escape and ASLR bypass: A second flaw allowed the exploit to escape V8’s memory sandbox and identify where Chrome’s code was located in memory. A return-oriented programming (ROP) chain then gave the attacker full control of the renderer process.

CacheStorage race condition: The renderer process remained confined by Chrome’s process sandbox. However, a race condition in CacheStorage allowed it to read memory outside that sandbox and determine the memory layout of the privileged browser process.

FedCM use-after-free: A use-after-free vulnerability in FedCM, Chrome’s federated sign-in feature, enabled arbitrary code execution outside the sandbox.

Google assigned 62 Common Vulnerabilities and Exposures (CVEs) to the issues and patched them as of Chrome 156. All the vulnerabilities are rated critical or high. Thirteen involve sandbox escapes, while 21 could be used to compromise the renderer process.

Safari: A data-only exploit that disables the same-origin policy

The exploit allows JavaScript running on any website to bypass the same-origin policy completely. This allows it to access a user’s Safari browsing history and cookies, send authenticated requests to other domains, and read the responses. An attacker could therefore access information from accounts such as signed-in email services or banking sessions.

The exploit bypassed four security layers:

JavaScriptCore use-after-free: Certain TypedArray operations used stale pointers to freed memory, allowing the exploit to overwrite TypedArray metadata.

Gigacage bypass: WebKit’s Gigacage isolates TypedArray data in a separate memory region. The model identified variables within that region that could be used to access other memory regions, enabling arbitrary read and write operations outside it.

WebContent sandbox IPC flaw: A vulnerability in the sandbox’s inter-process communication (IPC) mechanism allowed the exploit to access Safari’s stored browsing history, cookies and session databases on disk.

Disabling the same-origin policy: The use-after-free vulnerability allowed the exploit to overwrite a variable in memory and disable the same-origin policy. This enabled the attacker’s webpage to read data from any other origin.

This is a data-only attack and does not require arbitrary code execution. Instead, it uses read and write access to browser process memory to modify a security flag, an object size and a URL. Anthropic notes that some of these weaknesses involve intended behaviours that become exploitable when combined.

Apple acknowledged the report on the day Anthropic submitted it and has since released a fix.

Android: Extracting data from a locked phone

The exploit extracts photos and personal information from a stolen Android phone without requiring the device to be unlocked. The model used three inputs: an analysis of Android’s open-source code, reverse engineering and deobfuscation of Google Play services binaries, and live testing on a Pixel 9 device.

This process revealed several vulnerabilities in both open-source and proprietary components. The model combined three of these flaws to develop the final exploit.

The attack bypassed four security protections:

USB data restrictions on locked phones: A USB host with a specific setting bypassed the restriction on transferring data from a locked phone.

Device-to-device transfer authorisation: The model bypassed the authorisation check and initiated the pairing process.

Six-digit code verification: A vulnerability allowed the exploit to skip the user’s confirmation and proceed as though the user had tapped “Allow”.

Restrictions on file transfers over USB: A hardcoded check blocked access to file contents. However, a fallback mechanism that transmitted raw bytes was not covered by this restriction. The exploit requested the file contents through this alternative route.

Google has addressed the issue.

Windows: Remote crashes through HTTP/3

The exploit can crash any Windows machine that responds to HTTP/3 requests through Microsoft’s native Windows implementation. The vulnerability involves an out-of-bounds read in the Windows kernel’s QUIC implementation, which is accessible over a network.

An attacker can send a small number of packets to a server running the service to crash and restart the machine. Repeating the attack can keep the server unavailable to users. Anthropic estimates that several million such servers are exposed to the internet.

Microsoft has addressed the vulnerability under CVE-2026-33096.

Finding the vulnerability required the model to reverse-engineer the Windows executable. Anthropic asked it to:

Analyse how the software works using existing tools such as Ghidra.

Write a fully annotated C program that reproduces the relevant features.

Compare the reproduction’s behaviour with that of the original binary to verify its accuracy.

Examine the code for vulnerabilities.

When Anthropic asked the model to identify higher-risk vulnerabilities, it found the remotely exploitable flaw.

Linux: Zero-click root access through multipath TCP

A remote attacker can send packets to a Linux server running a multipath TCP listener and execute arbitrary commands with root privileges. The attack requires neither credentials nor user interaction.

The vulnerability involves a race-condition-induced use-after-free flaw in the Linux kernel’s networking stack (CVE-2026-98432). Developers have patched it upstream and backported the fix to all maintained stable kernel branches.

The exploit works in two stages:

Bypassing KASLR remotely: The race condition causes the kernel to read an attacker-controlled length field and copy additional bytes back to the attacker. If the returned data contains a kernel pointer, the attacker can identify the kernel’s memory layout.

Hijacking control flow: The same use-after-free vulnerability allows the attacker to overflow a buffer and overwrite a callback pointer with the address of a payload previously placed in kernel memory through a standard protocol feature. When the kernel invokes the callback, the payload uses existing kernel functions to execute an attacker-chosen shell command with root privileges.

If the attacker loses the race, the handshake simply fails without crashing the system. This allows the attacker to retry the process indefinitely.

In the proof of concept, obtaining a kernel pointer took 48 minutes. Reaching the point of command execution required another five minutes.

Anthropic also says the model identified local privilege escalation vulnerabilities in OpenBSD, FreeBSD and Linux, along with several sandbox escapes in widely used sandboxing infrastructure and multiple vulnerabilities in web applications.

The post also describes other zero-click code execution vulnerabilities in the Linux networking stack that have already been patched and publicly disclosed. However, Anthropic provides technical details only for the multipath TCP vulnerability.

Limitations in the source

The following are gaps in the information provided in Anthropic’s post, rather than claims about the validity of its findings.

Model identity: Anthropic used an unreleased internal research model but did not identify it or explain how it relates to the models included in its Verification Program.

Independent verification: All the findings come from Anthropic’s own account. The post links to vendor advisories for Chrome and Apple’s fix, as well as National Vulnerability Database (NVD) entries for two CVEs. However, it does not include an independent evaluation of the results.

Cost and success rate: Anthropic does not disclose the number of attempts, computational resources used, false positives or targets on which the model failed to find vulnerabilities.

Prompting and human involvement: The post describes the exploit chains as results obtained “after initial prompting” but does not explain what the prompts contained or how much human guidance the model received afterwards.

Vulnerability identifiers: Anthropic does not provide CVE identifiers for the Safari and Android vulnerabilities or specify how many individual vulnerabilities were involved in either exploit chain.

Also read:

Anthropic blocks abusive behavior towards Claude, drops ban on campaign targeting in policy update

Anthropic launches Claude Security for enterprises, but stops short of Mythos-level capabilities

[googlesitekit-end-of-content]

WP QUADS Content Ad Plugin v. 3.0.5.1

For You

Read Reasoned by Nikhil Pahwa: How AI is changing our world

Sponsor a MediaNama Event