Anthropic Says Claude Built Five Exploit Chains Across Major Software

Anthropic says an unreleased Claude model went beyond finding software vulnerabilities, combining security flaws into five working exploit chains across major browsers and operating systems.

In research published Oct. 27, the company described demonstrations involving Chrome, Safari, Android, Windows, and Linux. One Chrome proof of concept reportedly escaped the browser sandbox after a malicious webpage was opened, while a Linux demonstration achieved root-level command execution.

The tests were conducted in controlled environments, not documented real-world attacks. But they raise a pressing question for security teams: can organizations identify and patch vulnerabilities quickly enough as AI systems become more capable of developing complex exploits?

Claude moved from finding bugs to building exploit chains

An exploit chain combines flaws to bypass multiple protections. Anthropic noted that Claude analyzed code, reverse-engineered software, and tested exploits after prompting.

In Chrome, the model reportedly linked four vulnerabilities: V8 memory corruption followed by flaws that bypassed memory protections and the browser sandbox. Anthropic said a malicious webpage triggered a proof of concept that launched macOS Calculator without further interaction.

Anthropic also reported that its broader Chrome research produced 62 CVEs, including 13 sandbox escapes, with fixes included by Chrome 156. The four-vulnerability chain was one demonstration within that larger research effort.

Five demonstrations crossed different security boundaries

The five exploit chains targeted different security weaknesses, with varying access requirements and consequences. Some began with a malicious webpage, while others required physical access or a particular network service.

According to Anthropic, Safari's chain bypassed the same-origin policy without arbitrary code execution, while the Windows demonstration caused remote system crashes. The Linux proof of concept took 48 minutes to expose a kernel address and five more to execute a root command.

What eWeek found: Exploit chains carry unequal risks

The findings reveal differences between working proofs of concept and practical threats. Access requirements, patch availability, and independent verification affect how security teams should interpret the results.

Exposure matters more than the number of exploit chains

The five demonstrations do not represent five equally urgent threats.

A browser exploit triggered by a malicious webpage presents a different exposure scenario from an attack requiring physical access to a locked smartphone. Likewise, network-based vulnerabilities depend on whether the affected services are enabled and reachable.

For security teams, the distinction matters when prioritizing remediation. A vulnerability affecting an exposed production service may warrant more immediate attention than one requiring an uncommon configuration or direct device access.

The demonstrations show why exploitability, access requirements, and patch availability must be assessed together rather than treating every working proof of concept as an equivalent threat.

Vendor fixes do not verify Claude's autonomy

According to The Hacker News, Google and Apple acknowledged that Anthropic researchers used Claude to help discover certain vulnerabilities. 

However, it remains unclear how much of the work Claude completed on its own and how much required human assistance. Anthropic has not disclosed the exact model used in the tests, and the reviewed sources did not identify a public Google advisory confirming the Android fix.

Vulnerability findings require careful interpretation

The Hacker News and Mallory provided additional details about the Windows and Linux vulnerabilities. Actual risks depend on affected software, system configurations, and exploit requirements. Security teams should check vendor advisories to confirm exposure and available fixes.

The tests demonstrate AI-assisted exploit development, but not confirmed real-world attacks using these exploit chains or fully autonomous exploitation.

Security teams must translate findings into verified fixes

Anthropic's demonstrations involved different security risks, so the appropriate response depends on the systems involved. Users, IT teams, and developers should focus on the vulnerabilities that affect the devices, services, or software they use and manage.

• Browser and mobile users: Install available browser and device updates, and protect phones against unauthorized physical access. The Android test required a USB connection.
• IT and security teams: Check exposed HTTP/3 and multipath TCP services, verify deployed patches, and compare affected configurations against vendor advisories.
• Developers: Scan proposed code changes, validate AI-reported flaws, and test fixes before release rather than assuming every finding is a working exploit.

“Fixing the existing backlog only solves half the problem,” Anthropic wrote, recommending security scans when developers propose code changes. 

For organizations, the immediate priority is to verify affected configurations, deploy available patches, and test new code for security weaknesses before release.

The larger implication is that finding individual vulnerabilities may no longer be the hardest part of exploitation. As AI tools become more capable of combining flaws, security teams will need to identify dangerous combinations before attackers can turn them into working exploit chains.

Want to get more useful results from AI tools like Claude? Try our free six-minute How to Talk to AI course to learn simple ways to write clearer prompts and work more effectively with AI. eWeek readers also get seven days of free access to The Neuron Academy’s other AI courses. Check out all the lessons here →