On October 27, Anthropic published five attack chains produced by an internal artificial intelligence model dedicated to research. They targeted Chrome, Safari, Android, Windows, and Linux, and the relevant vendors have since patched the vulnerabilities. According to the California-based company, Anthropic is also opening some of its code analysis models to businesses.
- Anthropic a publié cinq chaînes d’attaque créées par une IA interne visant Chrome, Safari, Android, Windows et Linux.
- Sur Chrome, l’IA enchaîne quatre failles et lance la Calculatrice depuis une page malveillante.
- Les éditeurs ont corrigé les failles, et Anthropic ouvre certains de ses modèles d’analyse de code aux entreprises.
- Anthropic recommande aux acteurs numériques d’auditer leur code à l’aide d’agents d’analyse.
In its post, the Frontier Red Team describes a demonstration on Chrome: a malicious page, opened in the browser on a Mac, launches the Calculator a few seconds later. Five of the world’s most widely used systems and software are affected.
Four Chained Vulnerabilities in Chrome
Chrome is the most affected software, with four ‘one-click’ vulnerabilities, meaning triggered by a simple user click. The image used by Anthropic is that of an office building where doors lock one after another: the AI would have crafted a key to open the next one. The starting point is a malicious webpage, whose code corrupts the memory of the V8 JavaScript engine. A second vulnerability bypasses V8’s internal protection to take control of the renderer process, responsible for displaying the page. This process is confined in a ‘sandbox’, a sort of partition meant to prevent it from reaching the rest of the computer. A third vulnerability, exploiting two simultaneous operations, allows escaping the sandbox, and a fourth executes code outside this framework. To validate the attack, the Frontier Red Team launched the Calculator with user privileges. Google announced it had patched 62 vulnerabilities reported by Anthropic, all critical or high severity, including 13 allowing sandbox escape and 21 that could compromise the renderer. These patches notably concerned Chrome 156.
Windows, Linux, Android, and Safari
On Windows, the discovered vulnerability is a denial-of-service attack, which makes a service unavailable. Identified by Microsoft under reference CVE-2026-33096, it allowed remotely crashing an HTTP/3 server, a recent web data transfer protocol. Anthropic estimates several million servers were affected.
For Linux, it is a ‘zero-click’ vulnerability, requiring no action from the victim, which allowed obtaining remote privileges on a server. According to the company, the demonstration lasted less than an hour, and a failed attempt does not crash the system, facilitating successive tries.
On Android, three combined vulnerabilities were identified, but only on one device, the Google Pixel 9. They would have allowed extracting photos from a locked smartphone via a USB cable. The vulnerabilities bypassed USB blocking, authorized the transfer, and circumvented the six-digit code verification as well as content control of the files. Finally, Safari was subject to another ‘one-click’ vulnerability. The AI reportedly managed to access the browser’s history, cookies, and sessions, and to send authenticated requests to other domains.
The affected companies were informed and have released patches. Anthropic recommends that digital actors check their code, notably using analysis agents, to spot other vulnerabilities. The company announced it is opening some of its models intended for code analysis to businesses, namely Claude Opus 5.5, Sonnet 5.5, and Mythos 5.1.
