Anthropic model’s Chrome findings led to 62 patched CVEs

An unreleased internal research model at Anthropic wrote five exploit chains against Chrome, Safari, Android, Windows and Linux, the company said. Each is a working proof of concept the vendor has since fixed, though every chain started “after initial prompting” and the model itself hasn’t been released.

In Chrome, the work produced 62 CVEs patched as of Chrome 156, all rated critical or high. The Linux chain gives a remote attacker root on servers with a multipath TCP listener, and the proof of concept took 48 minutes to leak a kernel pointer and another five to run the command.

Anthropic’s advice to defenders: “scanning your own code is more important than ever.”