Anthropic reports Claude's capability to discover and exploit critical software vulnerabilities

Overview of AI-Driven Vulnerability Research

Anthropic has demonstrated that frontier AI models can autonomously discover and chain multiple vulnerabilities to create sophisticated exploits in critical, real-world software. By utilizing an internal research model, the team successfully developed proof-of-concept exploits for browsers, operating systems, and kernel-level networking stacks. These findings highlight a shift where AI can perform complex, multi-step security research that was previously the domain of highly specialized human teams.

Key Vulnerability Findings

Anthropic documented five specific attack chains, all of which have been reported to vendors and subsequently patched:

  • Google Chrome: A multi-stage exploit chain allowed for remote code execution (RCE) outside the browser sandbox. The process involved memory corruption in the V8 engine, sandbox escape, and a use-after-free (UAF) vulnerability in the FedCM feature. This resulted in 62 CVEs being assigned and patched in Chrome 156.
  • Apple Safari: Researchers developed a data-only exploit that bypassed the same-origin policy (SOP) to access sensitive user data like cookies and history. The chain leveraged a UAF in JavaScriptCore and a sandbox IPC vulnerability, demonstrating that full memory read/write access can compromise security without traditional code execution.
  • Android: An exploit chain bypassed lock screen protections to extract personal data from a physical Google Pixel 9. The attack combined source code analysis, reverse engineering of Google Play services, and the chaining of three vulnerabilities to bypass USB data transfer restrictions and authorization checks.
  • Windows: A memory safety out-of-bounds read in the Windows kernel's QUIC implementation allowed for a remote denial of service (DoS). The model identified this by reverse-engineering the binary using tools like Ghidra and analyzing the resulting annotated C code.
  • Linux Kernel: A zero-click RCE was discovered in the networking stack. The exploit used a race condition-induced UAF to defeat KASLR and hijack control flow, allowing for root-level command execution. This vulnerability is tracked as CVE-2026-98432.

Methodology and Scaling

Anthropic’s approach emphasizes the importance of test-time compute scaling and the use of diverse scanning agents. By running large numbers of agents in parallel, the team was able to dynamically track code coverage and apply different strategies—ranging from pure coverage analysis to goal-based and threat-model-based testing.

To prevent the introduction of new vulnerabilities, Anthropic recommends integrating security scanning directly into the development lifecycle. They have released a Claude Code plugin for security guidance to assist developers in identifying potential issues at the pull request (PR) stage.

Implications for Security Professionals

These capabilities suggest that AI will significantly lower the barrier for discovering complex exploits. For defenders, this necessitates a more proactive security posture. Anthropic advocates for the use of advanced models to gain a headstart on patching. To support this, the company has expanded its Cyber Verification Program, providing qualified security professionals access to their most capable models—including Claude Opus 5.5, Sonnet 5.5, and Mythos 5.1—to facilitate automated vulnerability detection and remediation.

Sources