🔍 Read the full analysis: Why Security Teams Are Watching Anthropic’s Five AI-Built Attack Chains on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic said on October 27 that an unreleased research model found and chained software flaws into five working attack demonstrations involving Chrome, Safari, Android, Windows and Linux. Vendor records confirm some related fixes and credits, but Anthropic has not named the model or detailed how much human help it received; the demonstrations were conducted in a lab.
Anthropic’s Frontier Red Team said on October 27 that an unreleased Claude research model found software flaws and combined them into five working exploit chains affecting Chrome, Safari, Android, Windows and Linux. Anthropic said the demonstrations took place in a lab and that it reported the flaws to vendors before publication; records cited by the source show fixes for several findings, though details of the Android chain are not publicly verifiable there.
The examples vary in what an attacker would need to do. Anthropic said its Chrome demonstration could run code on a Mac as the logged-in user after someone visited a web page, with the Calculator app serving as visible proof. The company described the Safari chain as allowing a malicious site to read or alter data from other sites. Its account also describes an Android scenario requiring physical access to a locked phone, a Windows chain, and a Linux server exploit. The source identifies the Linux issue as allowing remote command execution with root privileges on certain servers and cites a public vulnerability rating of 9.8 out of 10.
Anthropic said the model combined the flaws “after initial prompting” and characterized the human involvement as little. The company has not named the model or published a detailed account of the researchers’ contributions, prompts or time spent. Those gaps make it difficult to judge how independently the system performed or reproduce a fair comparison with human-led security research.
The source writer says vendor records provide some corroboration. Google’s Chrome 156 release notes, dated October 20, list security fixes and credit Anthropic researchers on some entries, including cases marked as assisted by Claude. Apple’s advisory for iOS and iPadOS 26.5.2 credits researchers “with Claude, Anthropic” for a WebKit flaw. Microsoft’s advisory for CVE-2026-33096 also credits Anthropic researchers working with Claude. The writer says they found no public record verifying the Android chain, and could not reconcile Anthropic’s cumulative count of 62 Chrome CVEs with Google’s release notes.
Infographic 01 · What the model built
Five chains, five very different threats.
Anthropic says an unreleased Claude research model found the flaws and chained them into working exploits. All were reported to the vendors first; none is listed as exploited.
What it doesRuns code on the Mac, outside the browser sandbox
What it needsOne page visit, stock Chrome on macOS
FixedChrome 156, 20 Oct
vendor recordWhat it doesAny website reads data from your other sites
What it needsOne page visit
FixediOS / iPadOS 26.5.2, 29 Jun
vendor recordWhat it doesCopies photos off a locked, stolen phone
What it needsThe phone in hand, over USB
Fixed“Addressed by Google”
Anthropic's wordWhat it doesCrashes a server; repeat to keep it down
What it needsServer answers HTTP/3 (built-in)
FixedCVE-2026-33096, 14 Apr
vendor recordWhat it doesRuns commands as root, no login, no click
What it needsServer with a multipath TCP listener
FixedCVE-2026-98432, 15 Oct
CVE yes, link: AnthropicConfirmed in vendor records
- Chrome 156: 353 security fixes, 15 credited to an Anthropic researcher (4 critical, 11 high; my count)
- Apple: CVE-2026-43715 credited to two Anthropic researchers “with Claude”
- Microsoft: acknowledges an Anthropic researcher and Calif.io “with Claude”
- Linux: CVE published, rated 9.8, fixed in stable kernels
Anthropic’s word only
- That the model did the chaining “after initial prompting”
- “Little human involvement”, with no breakdown
- 62 Chrome CVEs in total, and the Android fix
- Which model it was: “unreleased, internal research model”
Five platforms are not five equal threats: two need only a page visit, one a stolen phone, one only crashes servers, one takes them over.Thorsten Meyer · my reading
Sources: Anthropic Frontier Red Team, 27 Oct 2026; Chrome 156 notes, 20 Oct; Apple iOS 26.5.2, 29 Jun; Microsoft CVE-2026-33096, 14 Apr; CVE-2026-98432, 15 Oct; CISA KEV, 28 Oct 2026. Counts in the Chrome notes: Thorsten Meyer.
Powered by Thorsten Meyer AI
AI Could Shorten the Exploit Window
The concern for defenders is less the Calculator demonstration than the possible reduction in time between a flaw becoming known and a working attack being assembled. Complex software protections often require attackers to combine multiple weaknesses; a chain can defeat safeguards that would contain any one bug on its own. If AI systems can reliably find and link those weaknesses with limited expert input, organizations may have less time to patch before attackers can adapt the work.
That risk should not be mistaken for evidence that these five demonstrations were used against real targets. Anthropic says the work was conducted in a lab and the flaws were reported to vendors. The source also notes that a separate Anthropic lab test, published in June, took less than an hour to turn a public Firefox fix into an exploit. That was a company-reported laboratory result, not a measurement of attacks in the wild. For security teams, the immediate practical point remains familiar: install available updates promptly and restart affected software or devices when needed.
Products Worth Considering
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
EcoFlow Smart Home Panel 2 Whole-Home Backup System Hub
As an affiliate, we earn on qualifying purchases.
What the Five Chains Covered
An exploit chain links weaknesses so an attacker can move past multiple layers of protection. In Anthropic’s Chrome example, the company described four flaws involving memory safety, a sandbox escape, a timing issue and a sign-in feature. It said the combination allowed code to run outside Chrome’s sandbox as the Mac user. Its Safari account described a different outcome: access to browser data across sites, rather than executing new code.
The reported cases are not equivalent in reach or prerequisites. The Chrome and Safari examples begin with a person visiting a page; the Android scenario described by the source requires a stolen phone in hand. The Linux finding concerns certain internet-facing servers and, according to the source, could permit root-level command execution. The source material gives less detail about the Windows and Android chains, so their mechanics and conditions cannot be independently compared from the information provided.
Anthropic’s post frames the work as a change in model capability, saying exploit chaining was historically associated with specialist teams. Its claims should be read alongside the vendor records rather than as independently established proof of how much the model did. The source also says Anthropic’s public models block most cyber work, while vetted security teams can apply for access to more capable tools; it notes that OpenAI has a similar effort.
Model Role and Android Evidence
Several important points remain unresolved in the material available. Anthropic has not named the internal model, disclosed a reproducible account of the work, or quantified human involvement. The company’s claim that the model produced five chains is therefore not enough by itself to establish how much of each discovery and exploit was automated.
The source writer reports finding no public record for the Android chain and says Anthropic’s total of 62 Chrome CVEs could not be reconciled with the cited Chrome release notes. Vendor credits support the existence of some related research and fixes, but do not verify every detail of Anthropic’s account. The material also does not establish that any of the demonstrations were used in real-world attacks or explain the precise conditions and affected versions for every chain.
Patch Status and Further Verification
The immediate next step for users and organizations is to apply the relevant browser, operating-system and server updates and follow vendor guidance on restarting affected products. The source says fixes have been released for the flaws it discusses, but readers should check the applicable vendor advisory for their software version and whether additional action is required.
Further clarity depends on fuller technical records from Anthropic and vendors, particularly for the Android case and the claimed Chrome total. Security teams will also be watching for evidence about whether AI-assisted exploit development changes the time attackers need after a flaw or patch becomes public. Anthropic’s demonstrations are lab results; the source provides no evidence of active exploitation tied to these chains.
Key Questions
Did Anthropic say these attacks were used against real targets?
No. Anthropic described the work as laboratory demonstrations. The source material reports no evidence that the five chains were used in real-world attacks.
Which platforms were included?
Anthropic named Chrome, Safari, Android, Windows and Linux. The source provides the most detail about the Chrome and Safari examples and the Linux server risk.
Are the reported flaws patched?
The source says fixes are available and cites Google, Apple and Microsoft records for several findings. Check the relevant vendor advisory and software version for update instructions; the source writer could not publicly verify the Android chain.
How much of the work did Claude do?
That is not clear. Anthropic said the model chained the flaws after initial prompting and described human involvement as little, but it did not name the model or publish a researcher-by-researcher breakdown.
Why are security teams paying attention?
The report suggests AI may help turn separate software flaws into a usable attack chain, potentially shortening the time defenders have to respond. The demonstrations do not establish that this is happening in active attacks, but they give defenders a reason to patch promptly and monitor new research.
Source: ThorstenMeyerAI.com
