Unreleased Anthropic AI system autonomously builds working exploits for Chrome, Safari, Windows, and Linux

An unreleased artificial intelligence model developed by Anthropic successfully identified security flaws in widely used software environments, including Chrome, Safari, Windows, and Linux, and combined these defects to create functional invasion codes. The Frontier Red Team, the security division of the company, disclosed these findings in a report published on Tuesday, October 27, 2026. The system demonstrated the ability to chain multiple vulnerabilities together to execute attacks, a task that typically requires highly specialized human teams. The researchers noted that the attack codes were constructed in a laboratory setting following initial commands given to the model, with no record of real-world attacks exploiting these specific flaws on the internet. One cited experiment involved the technology opening the calculator application on a Mac computer equipped with the Chrome browser immediately after a web page loaded, without any additional user interaction. The level of autonomy displayed by the system attracted significant attention from the digital security community, although it remains difficult to determine the exact extent of human involvement behind the scenes because Anthropic did not detail the specific steps of the process or reveal the identity of the model used.

All reported vulnerabilities have already been corrected by the respective responsible companies. Anthropic emphasized in a technical report that the intention behind the research is to strengthen system defenses, noting that the same capability allowing a security team to find and fix a vulnerability can also help a malicious agent exploit it. The company stated that access to advanced AI models with cyber capabilities should be regulated to assist defense professionals, and it expanded its security verification program to allow enterprise and government teams to use advanced versions of the technology to audit code and anticipate failures before cybercriminals can act. In the case of the Chrome browser, the model utilized four different flaws in sequence to execute commands outside the browser's secure isolation environment. Google corrected these issues in version 156 of Chrome, released on October 20, and credited the involved researchers in its official updates. The Google security team stated that they received reports from researchers using artificial intelligence and worked quickly to secure the platform before any malicious exploitation could occur.