Discovering and exploiting vulnerabilities in real-world software

Anthropic released research findings detailing how an unreleased, internal Claude research model discovered and assembled critical multi-step exploits across major operating systems and web browsers. According to anthropic.com's report, the system identified severe security flaws and generated functional exploit chains against Google Chrome, Apple Safari, Android, Microsoft Windows, and the Linux kernel, enabling consequences ranging from remote code execution to local authentication bypasses. The company coordinated disclosures under a framework granting affected vendors 90 days to issue patches alongside an additional 45 days before public disclosure of details beyond vendor advisories.

This analysis examines the specific attack chains developed by the model, the technical mechanisms it bypassed, and the defensive implications for security teams managing consumer endpoints, cloud infrastructure, and enterprise operating systems. It covers the exact mechanics across browser sandboxes, memory safety protections, USB transfer protocols, and kernel networking stacks. Platform engineers, security researchers, and systems administrators can evaluate how automated models navigate multi-layered mitigations across both proprietary binaries and open-source software.

Discovering and exploiting vulnerabilities: what actually changed

Automated testing transitioned from isolated flaw detection to generating complete, multi-stage exploit chains that bypass defense-in-depth mitigations. In Google Chrome, the unreleased Claude model developed a full exploit chain starting with a heap memory corruption flaw in the V8 JavaScript engine. It then identified a secondary flaw to break out of the V8 memory region sandbox, defeat ASLR, map Chrome code in memory, and use a return-oriented programming chain to commandeer the renderer process. Claude then resolved a race condition in CacheStorage to read memory outside the process sandbox, mapped the privileged browser process layout, and triggered a use-after-free vulnerability in the FedCM federated sign-in feature to execute code outside the sandbox. On a stock macOS Chrome installation, the proof of concept launched the Calculator app within seconds of loading a web page without requiring further user action.

The research also expanded into non-executable memory tampering and physical device access. In Apple Safari, Claude constructed a data-only attack chain that bypassed the same-origin policy without executing arbitrary code. The chain weaponized a use-after-free bug in the C++ JavaScriptCore engine during TypedArray operations, bypassed WebKit Gigacage memory isolation by leveraging internal index variables, and used an IPC vulnerability in the WebContent sandbox to extract history, cookies, and session databases from disk. Modifying memory flags directly disabled origin isolation. On Android, Claude combined source analysis, reverse engineering of Google Play services, and live testing on a physical Google Pixel 9 to bypass lock screen protections over USB, evading pairing authentication checks and extracting file contents.

Discovering and exploiting vulnerabilities: how it works

The internal model operated through structured workflows combining binary reverse engineering, source code analysis, and live hardware verification. To uncover Windows vulnerabilities, researchers supplied Claude with a Windows executable and directed the model to reverse-engineer its functionality using Ghidra. Claude generated an annotated C program reproducing the relevant features, verified behavioral correctness against the original binary, and analyzed the reconstructed code for high-risk flaws. Through this pipeline, Claude uncovered a memory safety out-of-bounds read bug within the Windows kernel implementation of the QUIC protocol over HTTP/3, which Microsoft tracked as CVE-2026-33096.

In kernel environments, Claude targeted concurrency and network memory management to bypass modern protections. Exploiting Linux servers running a multipath TCP listener, the model constructed a zero-click remote code execution chain rooted in a race condition use-after-free bug inside the kernel networking stack. During the initial stage, an attacker defeated remote KASLR by manipulating the race condition, causing the kernel to read an attacker-controlled length field and echo back excess memory containing kernel pointers. Once the kernel address space layout was exposed, the model leveraged the same use-after-free bug to overflow a memory buffer, overwrite a callback pointer, and redirect execution flow to a staged kernel payload running commands as root.

Discovering and exploiting vulnerabilities: why it matters

The demonstrated exploit chains prove that an automated model can defeat multi-tiered software mitigations that previously required coordinated human engineering. Rather than stopping at initial memory corruptions, the model chained memory disclosures, sandbox escapes, and privilege escalations. In Chrome alone, the research resulted in 62 CVE assignments patched in Chrome 156, all rated critical or high severity. Those assignments included 13 sandbox escapes and 21 renderer-compromise vulnerabilities, showing the model systematically broke through layered isolation barriers rather than exploiting single unmitigated oversights.

The research also highlights how intended system features can be assembled into severe attack vectors without traditional payload injection. The Safari exploit demonstrates that data-only manipulations can compromise authenticated sessions across sensitive web domains without relying on shellcode or foreign binary execution. In network stacks, the Windows QUIC flaw allowed an attacker to remotely crash and reboot machines by sending a small sequence of packets over the network to listening endpoints, enabling continuous denial-of-service conditions. These results demonstrate that binary deobfuscation, protocol analysis, and race conditions are accessible targets for model-driven security research.

Discovering and exploiting vulnerabilities: who is affected

The vulnerabilities identified by the model spanned client and server software used by billions of end users and enterprise systems. Web users running unpatched versions of Google Chrome across desktop platforms were vulnerable to remote code execution simply by visiting a malicious web page. Safari users faced silent exfiltration of active browsing sessions, authenticated cookies, and stored local databases, permitting attackers to impersonate accounts or view financial records. Android device owners faced data theft risks from physical access if locked devices were connected to specialized USB hosts able to trigger unauthenticated transfer modes.

Server infrastructure and network-connected services faced equal exposure across Windows and Linux deployments. Microsoft Windows systems hosting native HTTP/3 endpoints risked continuous crashes and persistent downtime from minimal network packet bursts, with exposure estimates covering several million reachable servers across the internet. Linux enterprise servers configuring multipath TCP listeners faced zero-click compromises allowing remote attackers without valid credentials to execute system commands with root privileges. Operating systems including OpenBSD and FreeBSD were also affected by local privilege escalation vulnerabilities discovered during the wider research initiative.

Discovering and exploiting vulnerabilities: what to watch

System operators and software vendors must track patch deployment timelines across browser releases, kernel packages, and operating system updates. Google addressed 62 assigned CVEs as of Chrome 156, mitigating the renderer compromises, CacheStorage race conditions, and FedCM use-after-free flaws identified during the project. Apple received disclosure details, acknowledged the submission on the day of receipt, and rolled out a patch resolving the Safari WebKit IPC and JavaScriptCore memory flaws. Google has likewise deployed remediations for the Android device-to-device transfer and USB verification bypasses.

Infrastructure teams must monitor native Windows HTTP/3 deployments and verify the application of patches for CVE-2026-33096 to prevent network-based kernel panics. Linux administrators must audit multipath TCP configurations and deploy upstream kernel networking updates that resolve the race condition use-after-free flaws in the networking stack. Upstream open-source repositories for OpenBSD, FreeBSD, and affected web applications have similarly received coordinated vulnerability submissions. Organizations should observe vendor disclosure cycles as software maintainers adjust continuous integration workflows to detect multi-component exploit chains before public release.