Anthropic's AI finds major software flaws

Anthropic's AI identified critical vulnerabilities in widely used software such as Chrome, Safari, Android, Windows, and Linux. These flaws could allow attackers to gain control of devices with minimal user interaction.

AI discovers vulnerabilities in major platforms

The vulnerabilities were found in major platforms that billions of users rely on daily, including web browsers, operating systems, and mobile platforms. These flaws are not limited to obscure or niche software.

Internal model identifies and exploits flaws

Anthropic's Frontier Red Team used an internal AI model to detect these vulnerabilities and develop working attacks. The model was not commercialized and was used solely for security research.

Attack on Chrome requires only a single click

One of the most notable attacks targeted Chrome, where a single click on a malicious webpage was enough to launch the Calculator app automatically. This demonstrated how an attacker could execute arbitrary programs on a user's machine.

Bypassing browser security with multiple flaws

To bypass Chrome's sandbox security, the AI combined four separate vulnerabilities. These flaws allowed the AI to corrupt memory, take control of the page, and ultimately escape the sandbox to execute commands.

Linux vulnerability allows zero-click attacks

A vulnerability in Linux, known as CVE-2026-98432, enabled a "zero-click" attack that could take full control of a server without any user action. This flaw exploited a race condition between two processor cores.

Attack on Linux required only 53 minutes

In Anthropic's test, the AI mapped the kernel's memory in 48 minutes and executed administrator commands in just five more minutes. This shows how quickly an attack could be carried out in real-world scenarios.

Safari's same-origin policy bypassed

On Safari, the AI bypassed the same-origin policy, which normally prevents websites from accessing data from other sites. This allowed the AI to access sensitive information like browsing history and cookies.

AI bypasses phone security without unlocking

On a locked Pixel 9, the AI used three combined vulnerabilities to extract photos via USB without unlocking the device or entering a verification code. This highlights the potential for serious security breaches.

Attack on HTTP/3 servers causes infinite loops

A few packets sent to HTTP/3 servers were enough to cause them to loop indefinitely. This could lead to severe disruptions for millions of machines using this protocol.

AI reshapes cybersecurity landscape

The discovery of these vulnerabilities comes shortly after PHP2Shell, another AI-driven security event. This suggests that AI is accelerating the pace of cybersecurity research and threats.

PHP2Shell involved long-dormant flaws

PHP2Shell revealed two long-dormant vulnerabilities in PHP, a language used by 70% of websites. These flaws allowed attackers to take over servers without a password, highlighting the risks of outdated code.

AI finds new vulnerabilities faster

While PHP2Shell focused on a single software, Anthropic's AI targets some of the most secure systems on the planet and combines multiple vulnerabilities into full attacks with minimal human input.

AI disassembles complex code for flaws

On Windows, the AI analyzed complex code that is difficult for humans to read, translating it into readable code to identify hidden flaws. This demonstrates the AI's ability to uncover vulnerabilities in industrial-grade software.

Anthropic's model remains private

Although Anthropic shared the vulnerabilities with software developers, it remains discreet about the extent of human assistance involved. The company emphasizes that all flaws were reported and fixed before public disclosure.

Security professionals get access to powerful models

Anthropic offers access to its advanced models for qualified security professionals. It also recommends using its tool, Claude Code, to analyze code changes and improve security.

Public should prioritize software updates

The general public is advised to install updates for browsers, phones, and computers promptly. With AI advancing rapidly, even a day's delay in updates can increase security risks.