Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits

Summary

Anthropic says an unreleased internal model found flaws in Chrome, Safari, Android, Windows and Linux and chained them into working proof-of-concept exploits in its lab, after prompting and without any real-world attacks. Every flaw was reported to the vendor first and is already patched. The company's account of how much of each chain the model built alone cannot be independently verified.

Mitigation

Fixes are reported by vendors: Chrome 156 (October 20), iOS and iPadOS 26.5.2 (June 29), CVE-2026-33096 patched April 2026 for Windows, and CVE-2026-98432 patched October 15 for Linux. Anthropic says Google has fixed the Android issue, with no public record found.

Related items

• MediumCVE-2026-111372: AI ChatBot for WooCommerce WoowBot plugin authorization bypass in RAG syncSame vendor · NVD/CVE Database
• MediumAttackers compromised 42 GitHub repositories by using files too large to be searchedSame vendor · CSO Online
• InfoChart: Anthropic's cash pile towers over nearly every U.S. companySame vendor · CNBC Technology
• LowBank of America kindly asks that you don’t share your banking password with your AI assistantSame vendor · TechCrunch (Security)
• InfoWalmart says AI training is boosting confidence with the technology among its 2.1 million associatesSame vendor · CNBC Technology