Anthropic reveals Claude built five exploit chains in lab tests

From bug finding to exploit chains

Anthropic recently shared research showing that an unreleased version of its Claude model can do more than just identify software vulnerabilities. The AI demonstrated the ability to combine multiple security flaws into five working exploit chains. These chains allow a system to bypass several layers of protection to achieve a specific goal.

An exploit chain is a sequence of flaws that work together to overcome security boundaries. In these tests, Claude analyzed code and reverse-engineered software to find these links. The model then tested the exploits after receiving specific prompts from researchers.

The research, published on October 27, involved several major platforms. The demonstrations targeted Chrome, Safari, Android, Windows, and Linux. While these were conducted in controlled environments and not documented real-world attacks, they show a significant leap in AI capabilities.

Technical breakdowns of the tests

One of the most notable demonstrations involved the Chrome browser. The model linked four distinct vulnerabilities, starting with V8 memory corruption. It then used flaws to bypass memory protections and the browser sandbox, eventually launching the macOS Calculator from a malicious webpage.

The Linux demonstration showed the model's ability to interact with the kernel. It took 48 minutes to expose a kernel address and an additional five minutes to execute a root command. This represents a high level of access within an operating system.

Other tests showed varying results across different platforms. The Safari chain bypassed the same-origin policy but did not achieve arbitrary code execution. Meanwhile, the Windows demonstration resulted in remote system crashes, and the Android test required a physical USB connection to succeed.

Interpreting the security risk

Not all of these exploit chains carry the same level of immediate danger. Security teams must evaluate risks based on how an attacker would actually reach the target. For example, a browser exploit triggered by a webpage is a different threat profile than one requiring physical access to a locked smartphone.

The accessibility of the vulnerability also matters for prioritization. A flaw in an exposed production service might require faster remediation than one that needs a specific, uncommon configuration. The research highlights that exploitability and patch availability are just as important as the existence of the flaw itself.

Anthropic noted that their broader Chrome research produced 62 CVEs. This includes 13 sandbox escapes, which are methods for moving out of a restricted environment. These specific vulnerabilities have already been addressed in Chrome 156, but the underlying capability of the AI remains a point of concern.

Human involvement and autonomy

There is still some ambiguity regarding how much of this work was performed by the AI alone. While Google and Apple acknowledged that Anthropic used Claude to help discover certain vulnerabilities, the exact level of autonomy is not fully clear. Anthropic has not disclosed which specific model was used during these tests.

The research serves as a demonstration of AI-assisted exploit development rather than fully autonomous exploitation. It shows that AI can significantly accelerate the process of turning known bugs into functional attacks. This puts pressure on security teams to keep pace with the speed of AI-driven discovery.

The company emphasizes that the goal is to improve security practices. Anthropic suggested that organizations should move beyond just fixing a backlog of bugs. They recommend performing security scans whenever developers propose new code changes to catch flaws early in the development cycle.

Next steps for security teams

For users and IT teams, the immediate takeaway is to stay current with software updates. Installing available browser and device updates is the most direct way to mitigate these types of risks. Users should also be cautious about physical access to their mobile devices, as some exploits require a direct connection.

Security professionals should focus on verifying their specific configurations against vendor advisories. This includes checking exposed HTTP/3 and multipath TCP services. By understanding which services are reachable, teams can better prioritize which patches to apply first.

Developers are encouraged to validate any AI-reported flaws before assuming they are working exploits. Instead of reacting to every finding, they should test fixes and scan proposed changes. As AI tools become more capable of combining flaws, the focus must shift to identifying dangerous combinations before they can be weaponized.

Recommendations for the reader

Watch