Explore how an unreleased Anthropic AI model discovered and chained security flaws across Chrome, Safari, Android, Windows, and Linux into working lab exploits.
Discoveries include multi-bug browser chains, an Android USB data-access flaw, and network issues tracked as CVE-2026-33096 and CVE-2026-98432, all responsibly disclosed and patched by vendors.
According to the company, these examples were created in a controlled laboratory environment following appropriate commands, without any real attacks being recorded in the outside world. Anthropic promptly informed the manufacturers of any problems, as a result of which the necessary fixes have already been released.
The company's research team described a total of five different problem chains. In a typical demonstration, one of the examples opened the calculator app on a Mac running Chrome in a matter of seconds, without requiring any clicks from the user.
Although Anthropic says the process required initial commands and minimal human intervention, it remains unclear exactly how many steps were performed autonomously, and the company did not disclose which internal model it used.
How the attacks worked on the various systems
In the Chrome browser, the model used four different issues in succession, allowing commands to be executed outside the protected environment. Google has released fixes and credits Anthropic researchers, along with Claude's help, for specific changes.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
How ShinyHunters hit university and corporate systems
↗
In Safari, the chain allowed data to be read from other sites the user is logged in to. Apple fixed the memory issue and credited researchers at Anthropic who worked with Claude.
In the case of Android, the problem allowed photos and other data to be copied from a locked and stolen phone via a USB cable, with the company stating that Google has fixed it.
On Windows, an issue was identified that could cause a temporary outage via network requests. On Linux, the more complex case allowed commands to be executed with full administrator privileges over the network and without any prior login, if certain conditions were met.
G
HACKS.GR / GOOGLE SEARCH
Hacks.gr on Google
Set Hacks.gr as a preferred source.
Preferred source
↗
end of article
Top comments (0)