Anthropic AI model chains multiple flaws into working exploits

Automated exploit chaining

Anthropic recently disclosed that an unreleased internal AI model successfully identified and chained multiple security flaws into working proof-of-concept exploits. These exploits targeted major platforms including Chrome, Safari, Android, Windows, and Linux. The company noted that this capability was previously the work of specialized human security teams.

The research was conducted by Anthropic's Frontier Red Team in a controlled lab environment. The model required only initial prompting and minimal human involvement to produce the results. Anthropic stated that the ability to produce a working exploit that anyone can verify is now something models can do with little human help.

While the model produced these results, Anthropic did not name the specific model used for the research. It was described only as an internal research model. The company published the findings to assist defenders and highlight the evolving capabilities of large language models in cybersecurity.

Impact on major browsers

The model identified several complex chains for the Chrome and Safari browsers. In the Chrome chain, the AI used four separate flaws in sequence. It first corrupted memory in the V8 JavaScript engine, then escaped the memory sandbox, and finally used a use-after-free bug to run code outside the sandbox entirely.

Google has since patched these issues, with Anthropic reporting 62 flaws to the company. These were all rated as high or critical, including 13 sandbox escapes. Google's release notes specifically credit Anthropic and its Claude model for assisting with several of these Chrome fixes.

The Safari chain functioned differently by targeting the browser's memory rather than running code. The model chained flaws to gain read and write access to memory and disable the same-origin policy. This would allow a malicious page to read a user's history, cookies, and signed-in requests. Apple has since patched the central use-after-free flaw in iOS and iPadOS.

Operating system vulnerabilities

The AI also discovered flaws affecting Windows and Linux systems. The Windows flaw was a denial-of-service attack where specific network packets could crash the machine. While it did not allow for data theft or code execution, it could keep a system offline if the packets were repeated.

The Linux chain was identified as the most serious in terms of potential impact. It allowed for root command execution over a network without a login if the target server ran a multipath TCP listener. The model leaked a kernel memory address to bypass defenses and then redirected the program to attacker-placed code.

Anthropic reported these flaws under a coordinated disclosure policy. This process gives developers 90 days to patch the vulnerabilities before the details are discussed publicly. The company also pointed security teams toward its Cyber Verification Program, which provides vetted professionals with access to its Claude models.

Verification and limitations

While Anthropic claims the model performed the heavy lifting, some details remain opaque to the public. The company does not provide a step-by-step breakdown of how much of each exploit chain the model built independently versus human guidance. It also does not specify the exact model used beyond its internal research designation.

Some of the public records for these bugs do not perfectly match Anthropic's descriptions. For example, the Windows bug record names a different component than the one Anthropic identified. Similarly, the Linux CVE record describes an IPv4 TCP fix rather than the multipath TCP one linked by Anthropic.

Despite these discrepancies, the fact that Apple and Google have issued patches is verifiable. These vendors have acknowledged the assistance provided by Anthropic's Claude model in resolving specific flaws. The results demonstrate that AI can now navigate complex software architectures to find and link multiple vulnerabilities.