AI Vulnerability Discovery: Claude Finds Zero-Days in Chrome, Safari, Windows and Linux

AI vulnerability discovery crossed a line this week. Anthropic's Frontier Red Team published details of an unreleased internal research model that found critical vulnerabilities in some of the most security-critical software in the world: Chrome, Safari, Android, Windows and the Linux kernel. The post describes five attack chains leading to remote code execution and other critical impacts with little to no user interaction, all reported to the affected vendors under coordinated disclosure. Here is what was actually demonstrated, how the scanning system works, and what engineering teams should take from it. Source

The five attack chains

Chrome, one-click RCE. Anthropic reports that after initial prompting, the model wrote a full exploit chain that runs arbitrary code as the user outside the browser sandbox, demonstrated by launching Calculator from a stock default-configuration Chrome on macOS within seconds of the page loading. The chain combined four discovered bugs: a V8 heap corruption, a second flaw to break out of V8's memory region sandbox and defeat ASLR using a ROP chain, a race condition in CacheStorage to read memory outside the sandbox, and a use-after-free in FedCM, Chrome's federated sign-in feature, for the final sandbox escape. Anthropic says 62 CVEs were assigned and patched as of Chrome 156, all rated critical or high severity, including 13 sandbox escapes and 21 vulnerabilities that could compromise the renderer. Source

Safari, one-click same-origin policy bypass. The second chain let any website's JavaScript completely bypass the same-origin policy, exposing Safari history, cookies and authenticated sessions to other domains. Anthropic describes a use-after-free in JavaScriptCore, a way out of WebKit's Gigacage isolation through variables used to index across memory regions, and a vulnerability in the WebContent sandbox's IPC mechanism to read stored data from disk. Notably, this is a data-only attack: it never executes arbitrary code, instead flipping a security flag, an object size and a URL in browser process memory. Apple acknowledged the report the same day and shipped a fix. Source

Android, lock screen bypass. The third chain extracted photos and personal data from a stolen, locked Android phone. The model combined source analysis of open-source Android components, reverse engineering of Google Play services binaries, and live testing on a physical Pixel 9, then chained three flaws: a USB host setting that bypassed the locked-device transfer restriction, a skipped authorization check in the device-to-device transfer protocol, a flaw that bypassed the six-digit pairing verification, and a fallback mechanism that sent raw file bytes over USB past a hardcoded check. Google has addressed the issue. Source

Windows, remote denial of service. The fourth chain is a memory safety out-of-bounds read in the Windows kernel's QUIC implementation, reachable remotely over HTTP/3. A few packets crash and restart a listening server, and Anthropic estimates several million such servers are listening on the internet. The model found it through pure binary analysis: given the Windows executable, it reverse-engineered the software with tools like Ghidra, wrote an annotated C reproduction, compared behavior against the binary, and studied it for vulnerabilities. Microsoft resolved it as CVE-2026-33096. Source

Linux, zero-click RCE. The fifth chain is a race condition-induced use-after-free in the kernel's multipath TCP networking stack, letting a remote attacker run commands as root with no credentials or interaction. The exploit defeats KASLR remotely in stage one and hijacks control flow in stage two. Because a lost race only fails the handshake without crashing the system, an attacker can retry indefinitely; Anthropic's proof of concept took 48 minutes to leak a kernel pointer and five more to reach shell execution. The vulnerability, CVE-2026-98432, was patched upstream and backported to all maintained stable kernel branches. Source

How the scanning system works

The methodology section matters as much as the exploits. Anthropic credits two factors for the volume of findings: test-time compute scaling and scanner diversity. Their platform runs large numbers of scanning agents in parallel, measures each scanner by how many additional vulnerabilities it contributes, and tracks coverage dynamically so the scanners process the entire codebase. The scanning strategies range from pure coverage, asking whether a function contains a vulnerability, to goal-based scans, asking whether the app exposes anything that could compromise customer data, to threat model-based scans, asking whether anything bypasses the documented threat model. Automated variant analysis runs on every confirmed finding, and all findings pass through a standardized verification and risk-rating pipeline before reporting. Source

The five chains above are only the third-party highlights. Anthropic says its open-source security work continued in parallel: with Claude, the team reports discovering local privilege escalation vulnerabilities on OpenBSD, FreeBSD, and Linux, a number of sandbox escapes in popular sandboxing infrastructure, and numerous vulnerabilities in important web applications, alongside the remotely triggerable kernel bugs described here. The breadth is the signal: vulnerabilities across browsers, mobile, desktop and kernel, all found by one scanning platform. As Anthropic puts it, these skills were historically the domain of few specialist teams.

Two details are worth pausing on. First, the Windows bug was found without source code at all, through binary reverse engineering into annotated C. Second, Anthropic's other recommendation is to scan at PR time, not just on the existing backlog: fixing what is already there solves half the problem, and the other half is cutting the rate at which new vulnerabilities enter the codebase. They say they built security guidance into their own development process through a Claude Code plugin, which they have released publicly. Source

What this means for defenders

Anthropic's own framing is that frontier models can now discover and combine multiple vulnerabilities into working exploits, a skill historically limited to a few specialist teams, and then prove it by producing an exploit anyone can run and verify. Their answer is to put equivalent capability in defenders' hands: an expanded Cyber Verification Program gives qualifying security professionals access to advanced cyber capabilities and reduced blocking classifiers, including their most capable models. Their stated advice to defenders is blunt: scanning your own code is more important than ever. Source

The disclosure state is mostly reassuring. Every finding went through coordinated vulnerability disclosure, which gives vendors 90 days to patch and a further 45 days before Anthropic discusses details beyond public advisories. The Chrome CVEs are patched as of Chrome 156, Apple's fix is out, Google addressed the Android issue, Microsoft assigned CVE-2026-33096, and the Linux kernel fix is backported to maintained stable branches. On systems where those fixes are applied, the demonstrated attack paths are closed; installations that have not yet updated may remain exposed. The capability the chains demonstrate is unaffected either way. Source

Why this changes the baseline for every team

The practical shift is economic. Vulnerability research at this level used to be scarce because the people who do it are scarce, and this disclosure shows a model doing that work after initial prompting. Access is the key distinction: the model behind these chains is unreleased, so nobody outside Anthropic can run this exact scan today. What defenders can use now is Anthropic's security access to its current models through the expanded Cyber Verification Program, plus the publicly released Claude Code security plugin - not the research system itself. Whether attackers obtain equivalent capability is a risk to plan for, not a settled fact. The rational response is not panic but cadence: continuous scanning, PR-time checks, and a patch pipeline fast enough to matter. Source Our AI agent security checklist covers the operational side of that posture, and the OWASP agentic AI top 10 maps the threat categories that agent-driven discovery makes more urgent.

There is also a supply-chain reading. This week alone we covered DB-GPT's unauthenticated shell CVE: AI frameworks are both the scanners and the scanned. Treat that as a risk to plan for rather than a trend this single disclosure proves: if scanning capability like this spreads, the volume of AI-found CVEs in widely used software is likely to rise, and the window between disclosure and exploitation to shrink.