Unreleased Claude built exploit chains for Chrome, Safari, and major OSes
Original title: Claude Model Builds Exploits Across Major Browsers & OSes
Anthropic says the model made five exploits, including Android data theft and Linux root code execution; vendors have patched.
Anthropic said an unreleased Claude found critical flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working exploits with little or no human interaction. Described cases include theft from a locked Android phone, zero-click root code execution on Linux, and remote crashes of Windows. A Chrome-on-macOS chain used four flaws to escape the sandbox and, as a proof of concept, launch Calculator from a malicious page. Anthropic's Frontier Red Team reported the issues, and the company said affected vendors have fixed them.
Unconfirmed: Findings and the claim that the exploits can be independently run come only from Anthropic; CVE IDs and versions are not given.
- Anthropic said the model produced five working exploits across those platforms.
- The Chrome chain combined JavaScript-engine, memory, isolation, and federated sign-in flaws.
- One case was zero-click remote code execution with root on Linux servers.
- A separate exploit could remotely crash Windows systems.
- Vendors addressed the reported vulnerabilities; no CVE identifiers are named.
Impact: Chained exploits for data theft, root code execution, or crashes
| Product | Affected |
|---|---|
| Google Chrome | — |
| Apple Safari | — |
| Google Android | — |
| Microsoft Windows | — |
| Linux | — |
- AI models
- Claude
From the original article
9 min read at darkreading.com
An unreleased version of the AI model has found and chained multiple vulnerabilities in Chrome, Safari, Android, Windows, and Linux, Anthropic says.
By Jai Vijayan · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.