HUMANX - HUMANX AI

Anthropic says an unreleased Claude model found security holes in Chrome, Safari, Android, Windows and Linux, then chained them together into working attacks. Google has since patched 62 Chrome flaws the work turned up, all rated critical or high. Every bug was reported to the vendor first and is already fixed, but the message to defenders is blunt: finding and weaponising bugs is no longer a job only a few specialist teams can do. What Anthropic found In a research post on Tuesday, Anthropic’s Frontier Red Team, the group that tests its models for dangerous capabilities, described five “attack chains” built by an internal research model that isn’t available in the Claude apps or API. An attack chain links several separate bugs so that one small step, such as opening a web page, ends in serious damage. The headline example is Chrome. Anthropic says the model strung together four flaws, starting in Chrome’s JavaScript engine and ending outside the browser’s sandbox, the walled-off area meant to stop a bad web page from touching the rest of the computer. Its proof of concept opened the Calculator app on a default Mac setup within seconds of a page loading, with no further clicks. The other four chains, by Anthropic’s account:

• Safari: a malicious website could read data from other sites the user was signed in to, such as email or a bank account. Apple fixed it.
• Android: photos and personal data could be pulled off a stolen, locked Google Pixel 9 over USB. Google has addressed it.
• Windows: a few network packets could crash any Windows server answering HTTP/3 requests through the built-in implementation. Anthropic estimates several million such servers are online.
• Linux: a remote attacker could run commands as the all-powerful root user on servers using a networking feature called multipath TCP, with no login at all.

What the vendors’ own records show The 62 Chrome CVEs (public IDs for security flaws) are Anthropic’s count across several releases. Google’s Chrome 156 release notes, published on 20 October, list 15 critical or high-severity fixes from Anthropic researcher Xinyang Ge, five of them marked “assisted by Claude”, TSN reports. Microsoft fixed the Windows bug in April as CVE-2026-33096, and the Linux flaw, CVE-2026-98432, was patched upstream this month. The exploits were built in a lab after the model was prompted, and none were seen in real attacks, The Hacker News notes. The bigger claim, that one model can find several flaws and combine them with little human help, rests on Anthropic’s own description of its work. Why it matters It is the second time in a week that AI has rewritten the bug-hunting timeline. Last week, AI helped researchers turn decades-old PHP flaws into working attacks, and the race to patch millions of websites is still on. Anthropic’s own advice is that defenders should be scanning their code with the same tools, and it is widening access to its most capable models for vetted security professionals through its Cyber Verification Program. For everyone else, the practical step is the boring one. Keep Chrome on version 156 or later, install the latest Safari, Android and Windows updates, and don’t put off restarts. Holes found this way get fixed faster, but the same capability will not stay in friendly hands for ever. The post Anthropic’s Unreleased Claude Hacked Chrome, Safari and Linux in Tests appeared first on DailyAI.

Source: https://dailyai.com/2026/10/anthropics- ... -in-tests/