Anthropic says an unreleased research version of Claude helped uncover serious security flaws in widely used browsers, operating systems, and other software. The company describes five exploit chains that could lead to remote code execution, data theft, or service outages, in some cases with little or no action from a victim.
The findings span open-source and proprietary software. Anthropic says it reported each issue to the affected vendor under its coordinated disclosure process, which allows 90 days for a fix before the company shares further details.
Now loading...
In Chrome, Claude assembled a chain of vulnerabilities that could let a malicious web page run code as the logged-in user, outside the browser’s sandbox. The proof of concept launched macOS’s Calculator app shortly after a page loaded, without requiring another click. The chain combined flaws in Chrome’s V8 JavaScript engine, memory protections, browser storage, and its federated sign-in feature.
Anthropic says Google assigned 62 CVEs to the reported Chrome issues and fixed them in Chrome 156. All were rated high or critical severity, including 13 sandbox escapes and 21 flaws that could compromise the browser’s renderer.
A separate chain in Safari could let JavaScript on a website bypass the same-origin policy, a key browser safeguard that normally prevents one site from accessing another site’s data. That could expose a user’s browsing history, cookies, and session information, or let an attacker make and read authenticated requests to services where the victim is signed in.
Rather than relying on arbitrary code execution, the Safari exploit used memory access to alter security-related data. Anthropic says Apple acknowledged the report on the day it was submitted and quickly released a fix.
On Android, Claude helped construct an attack that could retrieve photos and other personal files from a locked phone. The work involved reviewing Android’s open-source code, reverse-engineering Google Play services, and testing on a Pixel 9. The exploit combined flaws in USB handling and the device-transfer pairing process to get around protections intended to prevent an unauthorized computer from accessing a locked device. Google has addressed the issue.
Anthropic also reported a remotely exploitable flaw in Windows’ implementation of QUIC, a networking protocol. A few specially crafted packets could trigger a memory-safety bug in the Windows kernel and crash a machine listening for HTTP/3 traffic. Repeated attacks could keep a server offline, and Anthropic estimates that several million internet-connected servers may be affected. Microsoft fixed the issue and assigned it CVE-2026-33096.
For Linux, Claude produced a proof of concept that could let an unauthenticated attacker send network packets to a server with a multipath TCP listener and run commands as root. The flaw was a race condition in the kernel’s networking stack. Anthropic says the exploit could first reveal the kernel’s memory layout, then use the same bug to redirect execution to attacker-controlled code. Its demonstration took 48 minutes to obtain a kernel address and another five minutes to reach command execution. The vulnerability was patched upstream and backported to maintained stable kernel branches.
Anthropic says its broader work with Claude also found local privilege-escalation flaws in OpenBSD, FreeBSD, and Linux, along with sandbox escapes and vulnerabilities in widely used web applications. It says the Linux issue and other findings have since been patched and publicly disclosed.
The company credits its results in part to running many scanning agents in parallel, using different strategies to search code, and tracking how much each scanner adds to the findings. It also used Claude to look for related variants after confirming an issue, then passed discoveries through a standard verification and risk-rating process.
Anthropic argues that fixing known flaws is only part of the challenge: developers also need to prevent new vulnerabilities from entering software. The company recommends scanning proposed code changes and says it has made a security-guidance plugin for Claude Code publicly available.
The findings, Anthropic says, show that advanced AI models can combine separate weaknesses into functional exploits, a capability previously associated with specialized security teams. The company says it has expanded its Cyber Verification Program to give eligible security professionals access to advanced models and reduced blocking, and urges defenders to scan their own software.
