Unreleased Anthropic model chains security flaws into working exploits for Chrome, Safari, Windows and Linux
Anthropic's Frontier Red Team says an unreleased, internal research model found security flaws across Chrome, Safari, Android, Windows and Linux and combined them into five working proof-of-concept exploit chains, none of which were observed in real-world attacks. In the Chrome chain, the model linked four separate bugs, a memory-corruption flaw in the V8 JavaScript engine, a sandbox escape, a CacheStorage race condition and a use-after-free (a bug where software keeps using a piece of memory after it has already been freed) in the FedCM sign-in feature, to run code outside the browser sandbox from a single page load. Anthropic reported 62 flaws to Google ahead of publication, all now patched, and both Apple and Google credit the model, with human oversight, for specific fixes. Anthropic remains the only source for how autonomous the work really was, since it declines to name the model or detail how much human guidance each step required. For businesses assessing how mature AI has become at offensive security testing, the report shows capabilities once limited to specialist teams are moving into automated tools.
Sources
This summary was written automatically with AI from the public sources listed above and checked by an independent AI reviewer before publication. For full details, read the original source.