🔍 Read the full analysis: Five Working Attack Chains From AI: What’s Verifiable In Anthropic’s Report on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic’s Frontier Red Team says an unreleased Claude model assembled five working exploit chains affecting Chrome, Safari, Android, Windows and Linux. Vendor advisories confirm some related fixes and credit Anthropic researchers, but public records do not verify every chain or establish how much work the model performed.
Anthropic’s Frontier Red Team says an unreleased Claude research model found and chained software flaws into five working exploits affecting Chrome, Safari, Android, Windows and Linux. The demonstrations took place in a lab, Anthropic says, and the company says it reported the flaws to vendors before fixes were released; records from Google, Apple and Microsoft provide public evidence for some, but not all, of the reported work.
Anthropic described the chains in an October 27 post, saying the model combined separate weaknesses to get past protections that a single bug would not defeat. In its Chrome demonstration, the company says a web page caused the Calculator app to open on a Mac within seconds, without another user action. Anthropic characterized this as proof that the chain could run code outside Chrome’s sandbox, as the logged-in user. The Calculator launch was a demonstration, not evidence that users were attacked in the wild.
The five cases differ in access and impact. Anthropic says the Chrome and Safari chains could be triggered by visiting a page; its Safari account describes a route to reading and changing data across websites. The Android scenario required an attacker to have a locked phone and connect through USB, according to the source account. The Windows chain is included in Anthropic’s list, but the supplied material gives few technical details. The Linux flaw is described as enabling remote command execution as root on certain servers, without a password or user click.
Some parts can be checked against vendor records. Google’s Chrome 156 release notes list 353 security fixes and credit Anthropic researcher Xinyang Ge on multiple entries, including some that say Claude assisted. Apple’s iOS and iPadOS 26.5.2 advisory credits Anthropic researchers with Claude for a WebKit vulnerability. Microsoft advisory CVE-2026-33096 also credits Anthropic researchers, according to the source material. A public Linux CVE is reported with a 9.8 severity score out of 10. These records support the existence of related fixes and research credits; they do not independently establish every detail of Anthropic’s exploit demonstrations.
Infographic 01 · What the model built
Five chains, five very different threats.
Anthropic says an unreleased Claude research model found the flaws and chained them into working exploits. All were reported to the vendors first; none is listed as exploited.
What it doesRuns code on the Mac, outside the browser sandbox
What it needsOne page visit, stock Chrome on macOS
FixedChrome 156, 20 Oct
vendor recordWhat it doesAny website reads data from your other sites
What it needsOne page visit
FixediOS / iPadOS 26.5.2, 29 Jun
vendor recordWhat it doesCopies photos off a locked, stolen phone
What it needsThe phone in hand, over USB
Fixed“Addressed by Google”
Anthropic's wordWhat it doesCrashes a server; repeat to keep it down
What it needsServer answers HTTP/3 (built-in)
FixedCVE-2026-33096, 14 Apr
vendor recordWhat it doesRuns commands as root, no login, no click
What it needsServer with a multipath TCP listener
FixedCVE-2026-98432, 15 Oct
CVE yes, link: AnthropicConfirmed in vendor records
- Chrome 156: 353 security fixes, 15 credited to an Anthropic researcher (4 critical, 11 high; my count)
- Apple: CVE-2026-43715 credited to two Anthropic researchers “with Claude”
- Microsoft: acknowledges an Anthropic researcher and Calif.io “with Claude”
- Linux: CVE published, rated 9.8, fixed in stable kernels
Anthropic’s word only
- That the model did the chaining “after initial prompting”
- “Little human involvement”, with no breakdown
- 62 Chrome CVEs in total, and the Android fix
- Which model it was: “unreleased, internal research model”
Five platforms are not five equal threats: two need only a page visit, one a stolen phone, one only crashes servers, one takes them over.Thorsten Meyer · my reading
Sources: Anthropic Frontier Red Team, 27 Oct 2026; Chrome 156 notes, 20 Oct; Apple iOS 26.5.2, 29 Jun; Microsoft CVE-2026-33096, 14 Apr; CVE-2026-98432, 15 Oct; CISA KEV, 28 Oct 2026. Counts in the Chrome notes: Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Exploit Speed Matters
The security concern is the possible shortening of the time between finding a vulnerability and turning it into a usable attack. Browsers and operating systems rely on layered defenses, so an exploit chain can combine several weaknesses to cross those barriers. If AI systems can reliably assemble such chains, defenders may have less time to patch before attackers can use disclosed or leaked information.
That risk is not the same as proof of a current attack wave. Anthropic says its demonstrations were conducted in a lab and that vendors received reports before public disclosure. The immediate practical value of the report is as a warning about patch speed and coordinated disclosure, not evidence that the five chains are being used against the public.
Anthropic also points to a June lab test in which a model turned a public Firefox fix into a working exploit in under an hour. That is the company’s reported test result, not a measurement of real-world attack timing. For organizations, the practical response remains timely security updates and restarts where required, alongside monitoring for vendor advisories.
Products Worth Considering
Oral-B iO Series 7 Rechargeable Electric Toothbrush with 2 Brush Heads and Charging Travel Case
Philips Sonicare DiamondClean 9500 Smart Electric Toothbrush with 2 Brush Heads, Black
Blueair Blue Pure 511i Max Smart Air Purifier
As an affiliate, we earn on qualifying purchases.
What Vendor Records Confirm
Anthropic’s post says the internal model found flaws across five platforms and produced working chains after initial prompting. It does not name the model. The company says the work involved little human input, but the supplied account contains no task-by-task breakdown or independent audit of the model’s contribution.
Vendor acknowledgments offer a narrower check. Google’s Chrome 156 notes contain 353 security fixes; the source account counts 15 entries crediting Ge and says five explicitly mention Claude’s assistance. Apple credits Anthropic researchers with Claude on the cited WebKit issue, while Microsoft credits Anthropic researchers on CVE-2026-33096. Anthropic’s broader claim that its Chrome reports resulted in 62 CVEs patched by Chrome 156 is not reconciled in the source account with the release notes. The Android chain, in particular, has no public record identified there.
The account places the report against the history of patch delays, citing WannaCry’s spread 59 days after a Microsoft patch in 2017. It also refers to Anthropic’s own Firefox exploit test. These examples illustrate why a shorter exploit-development window could matter, but they do not show that the newly described chains were used in attacks or predict how quickly other actors could reproduce them.
“These skills have historically been the domain of few specialist teams.”
— Anthropic Frontier Red Team
What the Public Evidence Leaves Open
Public material cited in the source account does not verify every chain end to end. No Android record was found, and the Windows exploit’s mechanics are not described in the supplied details. The account also says Anthropic’s cumulative figure of 62 Chrome CVEs could not be reconciled with the release notes it checked. Vendor credits establish research involvement, but not the exact sequence of model actions or whether a chain can be reproduced under conditions beyond Anthropic’s lab.
Anthropic has not named the model, and its phrase “little human involvement” is not accompanied by a breakdown of prompting, debugging or researcher intervention. The supplied material reports that fixes are out, but does not provide a complete mapping from every chain to a vendor advisory and affected software versions. It is also unclear whether any of the flaws were exploited before patching; no such exploitation is established in the material.
Patch Verification and Follow-Up
Users and organizations should check the relevant vendor advisories and install applicable browser, operating-system and device updates. Because the source account does not give a complete version-by-version mapping for all five chains, administrators should rely on vendor guidance to determine exposure and whether a restart is needed.
Further reporting should look for advisories that identify the Android and Windows issues, clearer links between Anthropic’s claimed 62 Chrome CVEs and Google’s release notes, and a fuller account of human involvement. Until that information is public, the confirmed picture is partial: several vendor records credit Anthropic-related research, while the full scope and reproducibility of the five demonstrations remain dependent largely on Anthropic’s account.
Key Questions
Did the reported exploits affect people outside Anthropic’s lab?
The source material describes lab demonstrations and says Anthropic reported the flaws to vendors before fixes were released. It does not establish that any of the chains were used in real-world attacks.
Which parts of Anthropic’s account can be checked independently?
Google, Apple and Microsoft records cited in the source material credit Anthropic researchers on some security fixes. A Linux CVE is also reported with a 9.8 severity rating. Those records support related fixes and credits, but do not independently prove every demonstration detail.
How much did Claude contribute to building the chains?
Anthropic says the model worked with little human involvement, but the supplied account gives no detailed breakdown and does not name the model. The exact division of work remains unclear.
What should users do now?
Install applicable security updates for browsers and operating systems, following vendor instructions. The source material does not establish an active threat from these specific chains, but prompt patching reduces exposure to known flaws.
Source: ThorstenMeyerAI.com
