An unreleased Anthropic AI found and chained real bugs in Chrome, Safari, Android, Windows and Linux. All are patched, so updating is the whole fix.
Anthropic says an unreleased internal AI model found real security flaws in Chrome, Safari, Android, Windows and Linux, then combined them into five working attacks. One Chrome attack opened an app on a Mac seconds after a page loaded, with no clicks. A Safari attack could have read your cookies and acted as you on other sites.
The good news: Anthropic reported everything to the companies first, and every bug is fixed. Google alone got 62 Chrome flaws, all patched by Chrome 156.
Anthropic hasn't said exactly how much people helped the model, so the bigger claim rests on its word.
A malicious web page opened the Calculator app on a stock Mac running Chrome, seconds after loading, with no further clicks. That proof of concept was built by the Anthropic exploit model, an unreleased internal AI that the company says found and chained real security flaws in Chrome, Safari, Android, Windows and Linux.
Before you panic: none of these attacks were seen in the wild. Anthropic built them in its lab, reported each bug to the vendor under coordinated disclosure, and says every one is now fixed. For most people the takeaway is simple. If your browser, phone and computer are up to date, you’re covered. What’s new is who did the work, and how little help it needed.
Anthropic’s Frontier Red Team, its in-house group that tests what models can do, published details of five attack chains on October 27. An attack chain links several separate bugs, each one getting the attacker a little further, until the last step reaches something valuable. That stitching together has traditionally been skilled, slow human work.
The scale is the striking part. Anthropic says it reported 62 Chrome flaws that received official CVE identifiers, the standard ID numbers for security bugs. All were rated critical or high severity, and all were fixed as of Chrome 156. Among them were 13 sandbox escapes and 21 flaws that could have taken over the part of Chrome that draws web pages.
Google’s Chrome release notes name Anthropic researcher Xinyang Ge, working with Claude, on some of the fixes. Not every one of the 62 carries that credit. Apple credits Anthropic’s Milad Nasr and Nicholas Carlini, with Claude, for the Safari flaw at the center of that chain.
The Linux attack shows why these chains worry defenders. In Anthropic’s test it took 48 minutes to leak a kernel memory address and five more to reach a root shell. A failed attempt doesn’t crash the machine, so an attacker can simply keep trying. The bug behind it carries a 9.8 severity rating out of 10 and was fixed upstream on October 15. Anthropic estimates several million Windows servers could have been exposed to the crash bug, which is rated 7.5.
The Safari chain is the one to picture. With the same-origin policy switched off, a booby-trapped page could read your browsing history and cookies and act as you on other sites. If you were signed in to email, it could read your inbox. If you were signed in to your bank, it could see balances. That’s the real-world stakes of a bug most people will never hear about.
So update, today:
The capability claim rests mostly on Anthropic’s own account, and there are gaps worth knowing about. By the company’s account, people gave the model a starting prompt and then stayed mostly out of the way. It doesn’t break down what a person did at each step. It also doesn’t name the model beyond calling it an unreleased internal research model.
Some details don’t line up neatly with public records either. Anthropic describes the Windows bug as a flaw in the kernel’s QUIC handling, while the public record for that bug points to HTTP.sys, Windows’ built-in web request handler, and names no finder. The Linux bug’s public record describes a different part of the network code than Anthropic’s post does. The vendor credits for Chrome and Safari, on the other hand, can be checked.
Anthropic frames this as help for defenders. Finding and combining several bugs into one working exploit used to be the domain of a few specialist teams, it argues, and models can now do it while proving the result with code anyone can run. If attackers get similar tools, the people who maintain software need them first.
Its disclosure policy gives developers 90 days to patch, then 45 more before it shares details beyond a public advisory. It’s also pointing security teams to a bigger Cyber Verification Program. Vetted professionals who join get to use Mythos 5.1 along with Claude Opus 5.5 and Sonnet 5.5. Its main advice to software makers is to scan their own code, including every new change before it’s merged, and it has released a free Claude Code plugin for that.
No. Anthropic built them in a lab after prompting the model, reported every flaw to the vendor first, and says all of them are patched. None were seen in real attacks.
Anthropic says all 62 flaws it reported to Google were fixed as of Chrome 156. Updating to that version or later covers them.
No. It’s an unreleased internal model. Vetted security professionals can apply for access to Anthropic’s stronger public models through its Cyber Verification Program.
You're reading the quick version.
Read next
SiteGuard WAF vulnerability lets attackers run commands as root
A dangerous OS command-injection in SiteGuard Server Edition’s statistics feature could give attackers control of a host when the feature is on, with patches available now.
A now-fixed bug let a harmless-looking Android app borrow your work account's sign-in pass. Here's who was at risk and the one update to check today.
A judge has approved AT&T's $177 million deal, but there's still no official payment date. Here's the timeline, what you could get and how to avoid scams.
Researchers rebuilt wiped conversations from on-device AI assistants and even got them talking again. Here's who should worry and how to clear your tracks properly.
The Daily Brief
Every morning, the news that matters from AI, phones, apps and the people shaping tech. Explained in plain English. Free.
One email a day. No spam, unsubscribe anytime. Privacy policy
