First OpenAI, now Anthropic: Unreleased AI models uncover hundreds of security flaws

Anthropic says an unreleased, internal research model uncovered critical security flaws in Chrome, Safari, Android, Windows, and Linux. The findings follow OpenAI’s disclosure last month that its own unreleased cyber AI had discovered hundreds of software vulnerabilities, highlighting the cyber capabilities of upcoming AI models.

In a recent post, Anthropic detailed five attack chains that demonstrate how the unreleased Claude model can find vulnerabilities, combine them, and exploit weaknesses in some of the world’s most widely used software. The company said the attacks could achieve remote code execution and other serious impacts with little or no user interaction.

In one demonstration it showed Claude chaining vulnerabilities in Chrome to execute arbitrary code outside the browser’s security sandbox. Anthropic’s proof of concept launched the Calculator app on a Mac running a default Chrome configuration within seconds of a page loading, without requiring further user interaction.

The model also built an exploit chain against Safari that could bypass the browser’s same-origin policy, a security mechanism that prevents one website from accessing another site’s data. An attacker could potentially use the weakness to access browsing history, cookies, and authenticated sessions.

On Android, Claude found a way to extract photos and other personal information from a locked phone using a USB connection. Meanwhile, a flaw in Windows’ handling of HTTP/3 requests could let an attacker repeatedly crash vulnerable servers remotely.

The Linux finding was particularly serious. Anthropic said Claude developed an exploit that could let a remote attacker execute commands as root on a server running a multipath TCP listener, without credentials or user interaction.

“Frontier models have the ability to discover and combine multiple vulnerabilities into a working exploit,” Anthropic wrote, adding that while specialists possessed these capabilities in the past, new AI models are democratizing these skills.

The company said it reported the findings to the affected vendors through coordinated vulnerability disclosure. It used the examples to point to its Cyber Verification Program that helps defenders identify and fix weaknesses before attackers could exploit them.

Finding bugs before attackers do

Anthropic isn’t alone in finding serious flaws before its AI models reach the public.

Last month, OpenAI said its unreleased GPT-5.6-Cyber model had uncovered hundreds of vulnerabilities, including flaws in Chrome’s V8 JavaScript engine, a mobile operating system, a database and an operating-system kernel.

Both companies argue that AI can help security researchers find weaknesses before criminals do. But discovery is only the first step. Researchers must verify the findings, developers must prepare fixes, and administrators must deploy patches across potentially thousands of systems.

That’s where the race gets harder. Security experts warn that the key concern is that AI could accelerate vulnerability discovery beyond the pace at which organizations can investigate and fix problems.

The recent PHP2Shell vulnerabilities offer a real-world example of how quickly that window can close. The two critical flaws in PHP, a programming language used by millions of websites, received patches on October 21.

However, Amazon detected attempted exploitation against a decoy server as early as October 17, before the vulnerabilities became public. After disclosure, Cloudflare reported that attack attempts had surged from tens of thousands to millions.

The patching challenge also remains substantial. Recent scans found that millions of PHP services were still running vulnerable versions, even after fixes became available. That leaves security teams facing two tasks: finding flaws before attackers do, and closing them before attackers can work them into active exploits.

Anthropic and OpenAI have shown how much AI can help defenders with the first task. The ongoing PHP2Shell saga is a stark reminder that the second is just as important but depends on the response of the larger ecosystem.