Anthropic says an AI model it has not released found serious security flaws in some of the world's most widely used software and, in most cases, chained several of them together into attacks. In a post on Tuesday, Oct. 27, the company described five, against Google's Chrome browser, Apple's Safari, Android phones, Windows and Linux, and said each software maker has fixed the problem behind its attack. Because these products are so widely used, Anthropic says, any flaw in them could affect billions of people.
Browsers and phones are built with several layers of protection, so a single flaw is often not enough to take over a device. A browser, for example, runs each web page inside a sandbox, a walled-off space meant to keep a bad page away from the rest of the computer. Anthropic's attacks on Chrome, Safari and Android each had to chain several flaws, one to get a foothold and others to get past each wall. Anthropic says that skill has long belonged to a few specialist teams, and that AI models can now do it with little human involvement. In each case it described, people gave the model its first instructions, and for Windows they also handed it the program and set out the steps it should follow.
In Chrome, Anthropic says, the model linked four flaws so that opening one web page let an attacker run their own code on the computer with the user's permissions, outside the browser's sandbox. Its demonstration opened the Calculator app on a Mac within seconds of the page loading, with no further clicks. Anthropic says its reports to Google have led to fixes for 62 flaws so far, each given an official tracking number and all rated critical or high severity, the latest in Chrome 156, which Google began rolling out on Oct. 20.
In Safari, Anthropic says, a different chain let any website read a person's browsing history and cookies, the small files that keep people signed in, and act on other sites as that person. An attacker could then read their email, or see their bank balance and try to move money, if they were signed in. Apple fixed it in a June update for iPhone and iPad, and its security notes credit two Anthropic researchers working "with Claude."
On Android, Anthropic says, the model built an attack that pulls photos and other personal information off a stolen phone, connected by cable, without unlocking it. It was tested on a Google Pixel 9, and Google has fixed the problem. On Windows, the model wrote an attack that could have crashed, over the internet, any Windows server that uses Windows' own built-in software to handle the newest version of the web's basic protocol, and kept it down by repeating the attack. Anthropic estimates several million such servers are online. Microsoft fixed it, and the U.S. government's database of known software flaws lists it as one that lets an attacker without any permission shut down service over a network.
On Linux, Anthropic says, the model built an attack that let someone take complete control of a server, running any command with the system's highest privileges, just by sending it network traffic, with no login and no action by anyone at the server. It works only on servers set up to use a particular networking feature, and in Anthropic's test it took about 53 minutes to succeed. The flaw has been fixed in Linux, including older versions still maintained. Anthropic says it told each software maker about its flaw before going public and gave it time to fix it, and that people who maintain software should scan their own code for flaws more than ever. Anthropic describes the model as a version of Claude but has not named it or said whether it will release it, and it has said little about how much work people did on each attack after the first instructions.