# Anthropic says unreleased model built working exploits for Chrome, Safari, Windows, Linux

Digest AI · Research · published 2026-10-28T01:15:00Z

Canonical: https://digestai.news/story/anthropic-says-unreleased-model-built-working-exploits-for-chrome-safa

## Summary

Anthropic reported that an unreleased internal AI model identified security flaws in major operating systems and browsers, chaining them into working proof-of-concept exploits. The company stated the model required only initial prompting and little human involvement to create these attacks, a capability it claims was previously limited to specialist teams. All identified flaws were reported to vendors and are now patched.

The report details five distinct exploit chains. The Chrome chain used four flaws to escape the sandbox and run code, with Google crediting Anthropic for 62 fixed bugs. The Safari chain disabled the same-origin policy to steal data without executing code. The Windows chain caused a denial-of-service via a kernel bug, while the Linux chain achieved root access over the network. Apple and Google publicly credited Anthropic researchers and its Claude model for specific fixes.

Skepticism remains regarding the degree of human assistance, as Anthropic did not name the specific model or detail human steps. The Linux exploit is linked to a high-severity CVE, though public records describe the fix differently than Anthropic's post. Anthropic frames this as a defensive measure, urging security teams to use its Cyber Verification Program to access advanced models for vulnerability detection.

## Key points

- Anthropic's unreleased model chained flaws into working exploits for Chrome, Safari, Windows, and Linux.
- Google and Apple credited Anthropic and Claude for specific security fixes in their release notes.
- The Linux exploit achieved root access over the network, linked to a 9.8-rated kernel CVE.

## Why it matters

This demonstrates AI's potential to automate complex vulnerability discovery and exploit development, shifting the balance in cybersecurity. It highlights the need for defenders to adopt AI tools to keep pace with automated attack capabilities.

## Sources

1. [Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits](https://thehackernews.com/2026/10/anthropics-unreleased-ai-model-chains.html) (thehackernews.com, 2026-10-28)

## Cite

Digest AI, "Anthropic says unreleased model built working exploits for Chrome, Safari, Windows, Linux", 28 October 2026, https://digestai.news/story/anthropic-says-unreleased-model-built-working-exploits-for-chrome-safa

---

Written by Digest AI's editorial model from the linked sources; the sources are the record. Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse
JSON: https://digestai.news/story/anthropic-says-unreleased-model-built-working-exploits-for-chrome-safa.json