Claude identifies critical security flaws in Chrome, Safari, and Windows

Automated exploit discovery

Anthropic recently shared results from using an unreleased internal research model to find critical vulnerabilities in widely used software. The research targeted high-profile targets including browsers, operating systems, and mobile platforms. These systems are considered security-critical because they affect billions of people worldwide.

The model demonstrated an ability to create sophisticated, multi-step attack chains in both open-source and proprietary software. In several cases, the AI produced exploits that required little to no user interaction to succeed. This capability allows the model to move beyond finding single bugs to constructing full paths for remote code execution.

Anthropic followed a coordinated vulnerability disclosure process for all findings. This means they gave developers 90 days to patch the flaws before discussing specific details publicly. The goal of this research was to test the cyber capabilities of frontier models in a controlled environment.

Breaking browser protections

The model successfully identified a one-click remote code execution flaw in Google Chrome. It discovered a vulnerability in the V8 JavaScript engine that allowed a malicious page to corrupt memory. It then chained this with other flaws to break out of the memory region sandbox and take control of the renderer process.

For Safari, the model wrote an exploit that completely bypassed the same-origin policy. This allowed JavaScript on a website to access sensitive data like cookies, history, and even email content if a user was signed in. The attack was unique because it was a data-only exploit that modified security flags in memory rather than executing arbitrary code.

In the Chrome example, the model also found a race condition in CacheStorage and a use-after-free in the federated sign-in feature. These combined flaws allowed the exploit to execute code outside of the browser's sandbox. Google has since patched 62 high and critical severity vulnerabilities related to these findings.

Mobile and OS exploits

The research also targeted the Android operating system to find ways to bypass lock screen protections. The model combined source code analysis of open-source parts with reverse engineering of Google Play services binaries. It eventually created an exploit that could extract photos from a stolen phone without the user unlocking it.

To achieve this, the model found four distinct flaws in the Android security stack. It identified a way to bypass USB data transfer blocks, a method to skip authorization checks during pairing, and a flaw that bypassed the six-digit verification code. It also found a fallback mechanism that allowed raw bytes to be sent over USB.

On the Windows side, the model identified a memory safety out-of-bounds read in the kernel's implementation of QUIC. This vulnerability could be reached remotely over a network to crash any machine responding to HTTP/3 requests. Microsoft has already resolved this issue and assigned it a CVE number.

Linux kernel vulnerabilities

The team also discovered a zero-click remote code execution vulnerability in the Linux kernel's networking stack. This flaw allowed a remote attacker to run commands as root on servers using a multipath TCP listener without any credentials. The vulnerability was a race condition-induced use-after-free bug that was patched upstream and backported to stable branches.

The exploit worked in two stages. First, the attacker used the race condition to leak kernel pointers to defeat KASLR, which is a memory protection technique. Second, the attacker used the same bug to overflow a buffer and overwrite a callback pointer to run a staged payload.

The model's ability to find these flaws was aided by its capacity for binary analysis. Researchers provided the model with Windows executables and asked it to reverse-engineer the software using existing tools. The model then wrote annotated C programs to reproduce the features and study the code for weaknesses.

Scaling security research

Anthropic noted that test-time compute scaling and scanner diversity significantly increase the number of vulnerabilities found. They built a platform that runs many scanning agents in parallel to measure which strategies contribute the most to finding new bugs. These strategies range from checking for any vulnerability in a function to identifying specific threats to customer data.

The company argues that fixing the current backlog of bugs is only half the battle. They recommend scanning code at the pull request stage to cut the rate at which new vulnerabilities enter the codebase. To help with this, they released a Claude Code plugin that integrates security guidance directly into the development process.

For defenders, these findings mean that AI can now perform tasks that previously required specialist teams. Anthropic suggests that defenders should use these models to gain a head start on patching systems. They have released an expanded Cyber Verification Program to provide security professionals with access to their most capable models.