AI identifies multiple software flaws

An experimental version of Claude, an AI developed by Anthropic, has found and combined several security weaknesses in major software systems like Chrome, Safari, Android, Windows, and Linux. This shows how AI can be used to both find and fix vulnerabilities in digital systems.

Testing AI's cybersecurity abilities

Anthropic’s Frontier Red Team tested the AI over several months to understand its capabilities and risks. The AI used multiple tools to analyze complex software, with some agents looking at code and others searching for ways to access protected data or bypass security restrictions.

Exploiting browser vulnerabilities

On Chrome, the AI found a series of four flaws. The first two allowed it to corrupt the JavaScript engine’s memory and take control of how the browser renders content. The other two enabled the AI to escape the browser’s security boundaries and run code on the user’s computer. In tests, this led to the Calculator app launching automatically when a web page was opened.

Accessing protected data on other platforms

The AI found ways to access data that should be protected on Safari and Android, such as information from other websites or photos on a locked phone. On Windows, it caused a remote server to crash, and on Linux, it exploited a kernel flaw to run commands with full administrative privileges on a remote server without any user interaction.

Reporting and fixing the flaws

Anthropic reported 62 critical or high-severity vulnerabilities in Chrome to Google. Google fixed them in Chrome 156 and credited Anthropic for some of these discoveries. The ability to create working exploits helps developers understand the real impact of each flaw and decide which to fix first.

Balancing defense and risk

Anthropic suggests using AI to check every code change for vulnerabilities before they reach users. The company is also giving access to its most powerful models to some cybersecurity experts to speed up the discovery of flaws. However, these same capabilities could be used by malicious actors to find and exploit weaknesses more easily, potentially lowering the barrier for attacks.