🔍 Read the full analysis: Anthropic’s AI Built Five Working Attack Chains—Here’s What We Can Verify on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic said on October 27 that an unreleased research model, Claude, helped build five working exploit chains targeting Chrome, Safari, Android, Windows and Linux. Vendor advisories confirm some related fixes and researcher credits, but public records do not verify every chain or how much work the model performed.
Anthropic said October 27 that an unreleased research version of Claude helped turn vulnerabilities into five working exploit chains targeting Chrome, Safari, Android, Windows and Linux. The company says the flaws were reported to vendors and fixes are available, but independent records cited by ThorstenMeyerAI.com verify only some of the report’s details—not the full set of chains or the extent of the model’s contribution.
Anthropic’s Frontier Red Team described attacks that combine multiple weaknesses to get past layers of software security. In its account, the Chrome demonstration involved four bugs chained together. On a Mac, opening a web page led to the Calculator app appearing within seconds, without another user action. Anthropic said the resulting code ran outside Chrome’s sandbox as the logged-in user. The demonstration took place in a lab; it is not evidence that the exploit was used against people in the wild.
The five reported targets were Chrome, Safari, Android, Windows and Linux, but Anthropic’s descriptions indicate different access requirements and outcomes. The Safari chain was described as allowing a malicious site to access data from other sites in the browser. The source says the Android scenario required a stolen phone in the attacker’s hands, while the Linux chain reportedly allowed remote command execution as root on certain servers. It gives fewer verifiable details about the Windows and Android cases.
ThorstenMeyerAI.com checked vendor records and reported that Google’s Chrome 156 release notes, Apple’s advisory for iOS and iPadOS 26.5.2, and Microsoft’s advisory for CVE-2026-33096 credit Anthropic researchers, with some credits referring to Claude’s assistance. The article says Chrome 156 listed 353 security fixes and that its author counted 15 credits to a named Anthropic researcher, including five explicitly mentioning Claude. Anthropic’s broader claim of 62 Chrome CVEs could not be reconciled with those release notes, the outlet said. It found no public record confirming the Android chain.
Infographic 01 · What the model built
Five chains, five very different threats.
Anthropic says an unreleased Claude research model found the flaws and chained them into working exploits. All were reported to the vendors first; none is listed as exploited.
What it doesRuns code on the Mac, outside the browser sandbox
What it needsOne page visit, stock Chrome on macOS
FixedChrome 156, 20 Oct
vendor recordWhat it doesAny website reads data from your other sites
What it needsOne page visit
FixediOS / iPadOS 26.5.2, 29 Jun
vendor recordWhat it doesCopies photos off a locked, stolen phone
What it needsThe phone in hand, over USB
Fixed“Addressed by Google”
Anthropic's wordWhat it doesCrashes a server; repeat to keep it down
What it needsServer answers HTTP/3 (built-in)
FixedCVE-2026-33096, 14 Apr
vendor recordWhat it doesRuns commands as root, no login, no click
What it needsServer with a multipath TCP listener
FixedCVE-2026-98432, 15 Oct
CVE yes, link: AnthropicConfirmed in vendor records
- Chrome 156: 353 security fixes, 15 credited to an Anthropic researcher (4 critical, 11 high; my count)
- Apple: CVE-2026-43715 credited to two Anthropic researchers “with Claude”
- Microsoft: acknowledges an Anthropic researcher and Calif.io “with Claude”
- Linux: CVE published, rated 9.8, fixed in stable kernels
Anthropic’s word only
- That the model did the chaining “after initial prompting”
- “Little human involvement”, with no breakdown
- 62 Chrome CVEs in total, and the Android fix
- Which model it was: “unreleased, internal research model”
Five platforms are not five equal threats: two need only a page visit, one a stolen phone, one only crashes servers, one takes them over.Thorsten Meyer · my reading
Sources: Anthropic Frontier Red Team, 27 Oct 2026; Chrome 156 notes, 20 Oct; Apple iOS 26.5.2, 29 Jun; Microsoft CVE-2026-33096, 14 Apr; CVE-2026-98432, 15 Oct; CISA KEV, 28 Oct 2026. Counts in the Chrome notes: Thorsten Meyer.
Powered by Thorsten Meyer AI
Exploit Chains Could Shorten Response Time
The concern is not simply that an AI system can identify a software bug. A chain of flaws can turn separate weaknesses into a route around protections, making it possible to move from a browser page or exposed service to access that a single bug would not provide. If such work can be done faster or with less specialist effort, defenders may have less time between a vulnerability becoming known and a usable attack being developed.
That risk should be kept in proportion. Anthropic described controlled research and says it notified vendors before publication; the source material does not report real-world attacks using these chains. The public evidence also does not establish that Claude independently completed each step. Still, the report points to a security challenge for software makers and users: fixes matter only when they are distributed and installed before attackers can exploit the underlying weaknesses.
The source cites Anthropic’s June lab test, in which a model reportedly turned a public Firefox fix into a working exploit in under an hour. That is a company-reported laboratory result, not a measurement of attack activity outside the lab. It illustrates why defenders are tracking the speed of exploit development, while offering no basis to claim that every vulnerability will now be exploited that quickly.
Popular right now
Samsung 85-Inch QN70H Neo QLED 4K Smart TV (2026)
Vitamix 5200 Professional-Grade Blender, 64 oz. Container, Black
Roborock F25 BX Cordless Wet Dry Vacuum Mop
As an affiliate, we earn on qualifying purchases.
What the Vendor Records Show
Anthropic’s October 27 post frames the five cases as examples of models moving beyond finding individual bugs to assembling them into working attacks. The company says the model needed little human involvement after initial prompting, but the report does not give a detailed account of the prompts, human interventions, or time spent on each chain. It also does not name the research model.
According to ThorstenMeyerAI.com, Apple’s iOS and iPadOS 26.5.2 advisory, released June 29, credits a WebKit use-after-free vulnerability, CVE-2026-43715, to Anthropic researchers working with Claude. Google’s Chrome 156 notes and Microsoft’s advisory for CVE-2026-33096 provide additional vendor-side records tied to Anthropic researchers. These records support that related flaws were addressed and researchers received credit; they do not, by themselves, independently validate every exploit-chain detail in Anthropic’s account.
The source also notes the familiar gap between a security patch and its adoption. It cites WannaCry’s spread 59 days after Microsoft released a patch as historical context. That example does not predict how quickly these reported flaws could be exploited, but it underscores why patch availability and timely installation are separate parts of the response.
What the Public Evidence Cannot Confirm
Independent verification is incomplete. The source article says it found no public record for the Android chain and could not reconcile Anthropic’s total of 62 Chrome CVEs with the Chrome 156 release notes. Vendor credits confirm researchers’ involvement in some fixes, but they do not establish the exact methods or outcomes of all five demonstrations.
Anthropic has not, in the material provided, named the model or disclosed a case-by-case account of human involvement, prompts, development time, or the full technical evidence. The Android scenario’s precise vulnerability and patch status are not established by the source. Nor is there evidence here that any of the chains was used in a real-world attack. Those limits mean the company’s overall claims should be attributed to Anthropic rather than presented as independently proven facts.
Patch Adoption and Further Disclosure
The immediate practical step for users and organizations is to install available browser, operating-system and server updates, then restart affected applications or devices where required for patches to take effect. The source material does not identify a new emergency action beyond keeping software updated, and it does not say that the reported chains remain usable on fully patched systems.
Further clarity depends on vendor advisories and additional technical disclosure. Public records that identify the Android flaw, the other reported chains, and their fixes would allow outside researchers to compare Anthropic’s account with the underlying vulnerabilities. Anthropic’s methodology and a more specific accounting of human participation would also help establish what the model did and how reproducible the results are. Until then, the report is evidence of a controlled research claim with partial vendor corroboration—not proof of widespread attacks or autonomous exploitation across all five platforms.
Key Questions
Did Claude exploit real users or devices?
No real-world attacks are reported in the source material. Anthropic described laboratory demonstrations and said it reported the flaws to vendors.
Which platforms did Anthropic say were affected?
Anthropic reported chains involving Chrome, Safari, Android, Windows and Linux. The source article says public records verify some related fixes, but not every chain.
Are the reported vulnerabilities patched?
Anthropic said it reported the flaws to vendors and that fixes are out. Vendor records cited by ThorstenMeyerAI.com support fixes for some related vulnerabilities, but the article could not verify every case, including the Android chain.
How much of the work did the AI perform?
That remains unclear. Anthropic described little human involvement after initial prompting, but did not provide a detailed breakdown, name the model, or explain the human contribution to each chain.
Source: ThorstenMeyerAI.com
