Claude finds bugs across five platforms, 62 CVEs in Chrome alone

Anthropic has released a research report saying its internal Claude research model found flaws in Chrome, Safari, Android, Windows and Linux, and chained them into 5 working attack chains. All flaws were reported to vendors and fixed.

Chrome had the most issues. The report to Google led to 62 serious or high-risk CVEs, including 13 sandbox escapes, with fixes shipped in Chrome 156. After a starting prompt, Claude found the bugs and wrote exploit code on its own. A test could open the Calculator on a default Mac setup seconds after a page loaded.

The worst Linux flaw lets an attacker get root access just by sending packets, and verification took 53 minutes. A Safari bug chain could bypass same-origin rules to read logged-in data, and an Android attack could pull photos from a locked Pixel 9 over USB. Vendors have all pushed out fixes.