Anthropic says internal Claude model found critical Chrome and Safari flaws
🎧 Listen to this story
Anthropic says it used an unreleased internal Claude research model to find five sophisticated attack chains in open-source and proprietary software, including browsers and operating systems. According to the company, the chains enabled remote code execution and other critical impacts with little or no user interaction, and could affect billions of people.
In the cases described, the model found a one-click chain in Chrome that escaped the sandbox and executed code as the user, and a Safari chain that bypassed the same-origin policy and could access history, cookies and other sensitive data. Anthropic says it reported each vulnerability to the affected vendors. In Chrome’s case, 62 CVEs had been assigned and patched as of Chrome 156, all rated high or critical severity.
Why it matters · editorial interpretation
The case suggests that research models may help uncover complex vulnerability chains in widely used software, although the reported results and impacts are claims by Anthropic. The disclosure also highlights the importance of reporting such flaws to vendors before detailing them publicly.
Sources
SecurityResearch