Anthropic AI model chains zero-day flaws into working exploits

An unreleased internal research model from Anthropic has successfully identified and chained multiple security vulnerabilities across major platforms including Chrome, Safari, Android, Windows, and Linux. The company reported these findings in late October 2026, confirming that all vendors have since patched the flaws after receiving coordinated disclosure reports.

What happened

Anthropic’s Frontier Red Team demonstrated that a single AI model could find separate flaws and combine them into working proof-of-concept exploits, a task previously reserved for specialized human security teams. The company emphasized that these exploits were generated in a controlled lab environment through prompting and were never observed in real-world attacks. Every vulnerability was reported to the respective vendor before public disclosure, ensuring patches were available when the details were released.

The most striking demonstration involved a Chrome exploit on macOS. After a user visited a malicious page, the exploit opened the Calculator app within seconds without requiring any further clicks or interaction. This chain relied on four distinct vulnerabilities working in sequence: a memory corruption in the V8 JavaScript engine, a sandbox escape, a race condition in CacheStorage that leaked memory layout, and a use-after-free bug in the FedCM sign-in feature that allowed code execution outside the browser sandbox. Google credited Anthropic researcher Xinyang Ge, assisted by Claude, for specific fixes in Chrome 156, which addressed 62 reported flaws.

Other chains targeted different platforms with varying impacts. A Safari exploit disabled the same-origin policy, allowing a malicious site to read data from other sites where the user was logged in, such as email or banking portals. Apple credited Milad Nasr and Nicholas Carlini with Claude for the fix in iOS and iPadOS 26.5.2. An Android chain allowed data copying from a locked phone via USB, while Windows and Linux chains targeted server-side vulnerabilities. The Windows flaw caused a denial-of-service crash via HTTP/3 requests, and the Linux flaw allowed remote root command execution on servers running multipath TCP listeners.

How it works

The core capability demonstrated here is not just finding a single bug, but chaining multiple low-severity or isolated flaws into a high-impact exploit. In the Chrome example, the model did not rely on one critical error but orchestrated four separate issues. It started by corrupting memory in the JavaScript engine, then escaped the sandbox, used a race condition to map privileged memory, and finally leveraged a sign-in feature bug to break out completely. This multi-step logic requires understanding how different components of a complex software stack interact, a level of reasoning that AI models are increasingly demonstrating.

For the Linux exploit, the model bypassed Kernel Address Space Layout Randomization (KASLR), a defense that randomizes memory addresses to prevent attackers from knowing where to strike. The AI first leaked a kernel memory address, then used a race condition to redirect program execution to attacker-placed code. Anthropic noted that this process took 48 minutes to leak the address and five more to gain a root shell, but because failed attempts did not crash the system, an attacker could retry indefinitely. This persistence mechanism makes the exploit particularly dangerous despite the time required.

Key details

• Chrome: Exploit runs code outside the sandbox on macOS with one click; fixed in Chrome 156 on October 20, 2026.
• Safari: Disables same-origin policy to read cross-site data; fixed in iOS/iPadOS 26.5.2 on June 29, 2026.
• Windows: Denial-of-service crash via HTTP/3 packets; linked to CVE-2026-33096, patched April 2026.
• Linux: Remote root execution via multipath TCP; linked to CVE-2026-98432, patched October 15, 2026.
• Android: Data theft from locked device via USB; Google confirmed fix, but no public CVE record found.
• Disclosure: All flaws reported under a 90-day coordinated disclosure policy with a 45-day extension option.

Why it matters

For software engineers and security leads, this report signals a shift in the threat landscape. If AI models can chain vulnerabilities with "little human involvement," the barrier to creating sophisticated exploits lowers significantly. Previously, creating a reliable exploit chain required deep, niche expertise and weeks of manual reverse engineering. Now, the initial discovery and chaining logic can be automated, potentially allowing less skilled actors to weaponize vulnerabilities faster than defenders can patch them.

However, the same technology offers powerful defensive capabilities. Anthropic frames this work as a benefit to defenders, highlighting its Cyber Verification Program which provides vetted professionals access to advanced models like Claude Opus 5.5 and Sonnet 5.5. By using AI to proactively find and chain bugs, organizations can identify weak points in their own systems before adversaries do. The key takeaway is that AI-driven security testing is no longer theoretical; it is producing verifiable, working exploits that validate the severity of reported issues.

What you can do

• Update all browsers and operating systems to the latest versions, specifically Chrome 156+, iOS/iPadOS 26.5.2+, and recent Linux kernel updates.
• Review server configurations to disable unnecessary services like multipath TCP listeners if not required for your infrastructure.
• Implement strict Content Security Policy (CSP) headers to mitigate the impact of potential sandbox escapes in web applications.
• Evaluate AI-assisted security testing tools for your development pipeline to identify vulnerability chains early in the coding process.
• Monitor vendor release notes for credits related to AI-assisted findings, as this may indicate a higher volume of discovered flaws in future updates.
• Ensure physical security protocols for mobile devices are robust, as AI-discovered exploits may target local access vectors like USB debugging.