Signals/ Claude & Anthropic/ Brief /
Anthropic says an unreleased Claude model chained bugs into working exploits
Anthropic's red team showed proof-of-concept attacks on Chrome, Safari, Android, Windows and Linux. The flaws were reported and fixed first.
On October 27, Anthropic’s Frontier Red Team published results from an unreleased internal research model that found serious software flaws and linked them into working proof-of-concept attacks. The targets were Chrome, Safari, Android, Windows and Linux.
Anthropic says it reported every flaw to the vendors first, and fixes are out. For Chrome, 62 flaws received CVE numbers and were patched as of Chrome 156, all rated critical or high, including 13 sandbox escapes. Apple fixed the Safari issue, and the Linux and Windows bugs have CVE entries too.
Each chain started with “initial prompting” from a human, and the exploits were built in a lab. Nothing was seen in real attacks.
The catch: The capability claim rests on Anthropic’s own account. The Hacker News notes that Google’s credit does not cover all 62 Chrome flaws, and that some CVE records do not match Anthropic’s description of its bugs. Outsiders have not confirmed every detail.
What to do now
- Update Chrome, your phone’s operating system and Windows. Fixes only help once installed.
- If you run Linux servers, check that your distribution has applied recent kernel updates.
- Turn on automatic updates for browsers and devices your business uses.
Key terms
- Exploit chain: several separate bugs used in sequence, where each one gets an attacker a little further.
- Sandbox escape: a bug that lets code break out of the protected area a browser uses to contain web pages.
