🔍 Read the full analysis: What Anthropic’s AI Can Build Means For The Patch Window on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic’s Frontier Red Team says an unreleased Claude research model found and chained software flaws into working exploits affecting Chrome, Safari, Android, Windows and Linux. Vendor advisories confirm some credited fixes, but the model’s identity, degree of human involvement and the Android chain’s public record remain unclear. The report focuses attention on how quickly defenders can install fixes before a working attack is available.
Anthropic’s Frontier Red Team said on October 27 that an unreleased Claude research model found software flaws and combined them into five working exploit chains involving Chrome, Safari, Android, Windows and Linux. The report matters because it suggests AI could help compress the time between finding vulnerabilities and turning them into usable attacks, though the demonstrations were conducted in a lab and the company has not disclosed how much human work they required.
Anthropic said it reported the flaws to the affected vendors before publishing its account and that fixes have been released. Its Chrome example showed a web page opening the Calculator app on a Mac within seconds, without another user action. Anthropic described that as a demonstration of code execution outside Chrome’s sandbox, running with the user’s permissions. The source article says the Linux chain was the most serious: it reportedly let a remote attacker run commands as root on certain servers without a password or click. Anthropic’s demonstrations took place in a lab; the source does not report exploitation against real-world targets.
Some of the remediation can be checked in vendor records, according to the source article. Google’s Chrome 156 release notes and Apple’s advisory for iOS and iPadOS 26.5.2 credit Anthropic researchers, including work done with or assisted by Claude. Microsoft’s advisory for CVE-2026-33096 also credits Anthropic researchers. The Linux issue has a public CVE with a 9.8 out of 10 severity rating, while the article says it found no public record for the Android chain.
The reported platform chains differ in what they require and what they can do. Anthropic’s account describes the Chrome demonstration as requiring a page visit, while the Safari chain could let a site access data from other websites after protections were bypassed. The Android example reportedly required an attacker to have a locked phone in hand. The source material does not provide enough detail to independently establish the full conditions or outcomes for every chain, so Anthropic’s descriptions should be treated as the company’s account rather than independently verified demonstrations.
Infographic 01 · What the model built
Five chains, five very different threats.
Anthropic says an unreleased Claude research model found the flaws and chained them into working exploits. All were reported to the vendors first; none is listed as exploited.
What it doesRuns code on the Mac, outside the browser sandbox
What it needsOne page visit, stock Chrome on macOS
FixedChrome 156, 20 Oct
vendor recordWhat it doesAny website reads data from your other sites
What it needsOne page visit
FixediOS / iPadOS 26.5.2, 29 Jun
vendor recordWhat it doesCopies photos off a locked, stolen phone
What it needsThe phone in hand, over USB
Fixed“Addressed by Google”
Anthropic's wordWhat it doesCrashes a server; repeat to keep it down
What it needsServer answers HTTP/3 (built-in)
FixedCVE-2026-33096, 14 Apr
vendor recordWhat it doesRuns commands as root, no login, no click
What it needsServer with a multipath TCP listener
FixedCVE-2026-98432, 15 Oct
CVE yes, link: AnthropicConfirmed in vendor records
- Chrome 156: 353 security fixes, 15 credited to an Anthropic researcher (4 critical, 11 high; my count)
- Apple: CVE-2026-43715 credited to two Anthropic researchers “with Claude”
- Microsoft: acknowledges an Anthropic researcher and Calif.io “with Claude”
- Linux: CVE published, rated 9.8, fixed in stable kernels
Anthropic’s word only
- That the model did the chaining “after initial prompting”
- “Little human involvement”, with no breakdown
- 62 Chrome CVEs in total, and the Android fix
- Which model it was: “unreleased, internal research model”
Five platforms are not five equal threats: two need only a page visit, one a stolen phone, one only crashes servers, one takes them over.Thorsten Meyer · my reading
Sources: Anthropic Frontier Red Team, 27 Oct 2026; Chrome 156 notes, 20 Oct; Apple iOS 26.5.2, 29 Jun; Microsoft CVE-2026-33096, 14 Apr; CVE-2026-98432, 15 Oct; CISA KEV, 28 Oct 2026. Counts in the Chrome notes: Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Patch Speed Is Under Scrutiny
The concern is not simply that AI can identify a software bug. A vulnerability may have limited value to an attacker until it can be combined with other weaknesses into a reliable route through a product’s protections. Anthropic says its model produced that next step: working chains, not just isolated findings. If similar capabilities become broadly available, defenders may have less time between a flaw becoming known and an exploit being practical.
The source article points to the 2017 WannaCry outbreak, which began 59 days after Microsoft released a patch for the vulnerability it used. That comparison illustrates the stakes of patch delays, but it does not show that Anthropic’s demonstrations have been used in an attack or predict how quickly future attackers will act. The source also cites an Anthropic lab test published in June in which a model turned a public Firefox fix into a working exploit in under an hour. That was a company lab measurement, not evidence of a real-world attack or a general benchmark for all systems.
For organisations, the immediate implication is practical rather than speculative: apply relevant security updates promptly and restart devices or services when a fix requires it. AI-assisted research could also help security teams find and test flaws, but access to more capable cyber tools may be controlled. The source says Anthropic’s public models block most cyber work and that vetted security teams can apply for greater access. These are details of Anthropic’s stated approach, not a guarantee that all models or providers apply similar restrictions.
Popular right now
De'Longhi Rivelia Fully Automatic Espresso Machine with Milk Frother, White
Dyson V8 Cyclone Cordless Vacuum
Samsung 42-Inch Class OLED S90F 4K Smart TV (2025)
As an affiliate, we earn on qualifying purchases.
From Individual Bugs to Chains
Browsers and operating systems use layers of security, including sandboxes, to limit what a program or web page can do. An exploit chain links multiple weaknesses so an attacker can get past more than one layer. The source article says Anthropic described five such chains, spanning several platforms, and characterised this as a capability historically associated with specialist security teams.
Anthropic said its model made the chains “after initial prompting” and described the human involvement as limited. The source article reports that the company did not name the model or give a detailed account of the researchers’ contribution. Those omissions make it difficult to judge how much of the work was automated or reproduce the process from the public description.
The vendor records provide some independent evidence that flaws were addressed and that Anthropic researchers received credit. The source article also says Chrome 156’s release notes listed 353 security fixes, and that it counted 15 entries credited to one named Anthropic researcher; five explicitly mention Claude’s assistance. Anthropic’s separate claim that its Chrome reports had produced 62 patched CVEs is cumulative, and the source author says they could not reconcile that figure with the release notes. The numbers refer to different reported scopes and should not be treated as a single verified count.
““Several of the weaknesses are not vulnerabilities on their own but intended behaviors that become exploitable when combined.””
— Anthropic, as quoted in its report
How Much Was Automated?
The public account leaves important questions unanswered. Anthropic has not named the research model or provided a detailed record of prompts, researcher interventions or the time needed to build each chain. Its description of “little human involvement” is a company claim, and the source material does not supply enough information to assess it independently.
The source article says it could not find a public record for the Android chain. It also could not reconcile Anthropic’s cumulative total of 62 Chrome CVEs with the Chrome release notes it reviewed. Vendor credits establish that researchers were associated with some fixes; they do not independently confirm every technical detail or establish that all five demonstrations worked under the same conditions Anthropic described.
It is also unclear whether any of the flaws were exploited outside the lab, how quickly an unaffiliated attacker could reproduce the chains, or whether the demonstrations generalise to other software and models. The source reports vendor fixes, but does not provide a complete list of affected product versions, update status or mitigation steps for each platform.
Apply Fixes and Watch Advisories
Users and organisations should check the security advisories and update channels for the affected products, including Chrome, Apple operating systems, Windows and relevant Linux distributions. Install applicable security releases promptly, follow vendor instructions on restarting devices or services, and confirm that managed systems have received the updates. The source material does not identify a single action that covers every reported chain.
Further detail may come from vendor advisories, additional technical disclosures or a fuller account from Anthropic of the model and the researchers’ role. Until then, the report’s confirmed public record is narrower than its headline capability claim: some vendors credit Anthropic researchers on fixes, while the full workings and reproducibility of all five chains remain unverified from the information provided.
Key Questions
Did Anthropic’s model attack real users or systems?
The source says the demonstrations happened in a lab. It does not report that the chains were used against real-world targets.
Which products did the reported exploit chains involve?
Anthropic named Chrome, Safari, Android, Windows and Linux. The source material gives differing levels of detail for each and says it found no public record for the Android chain.
Are the reported flaws patched?
Anthropic says it reported the flaws to vendors and that fixes are out. The source article points to vendor records crediting Anthropic researchers for some fixes, but it does not provide a complete per-platform patch list.
How much did the AI do without human help?
That is not clear from the public account. Anthropic described the work as requiring little human involvement, but did not name the model or publish a detailed breakdown of researcher input.
What should users do now?
Check official product advisories, install applicable security updates and restart devices or services when vendors direct. Organisations should verify that updates reached managed systems.
Source: ThorstenMeyerAI.com
