Anthropic's secret AI extracted data from a locked Android phone and escaped Chrome's sandbox

Anthropic says an unreleased AI model found security flaws and combined them into working exploits targeting Chrome, Safari, Android, Windows and Linux. The company tested the exploits in controlled environments and says it reported the vulnerabilities to the affected vendors, which have since released fixes for all of them.

The company’s Frontier Red Team described five attack chains that the model developed with limited human help after receiving initial instructions. Anthropic has not named the model, announced when it might become available or fully explained how much researchers contributed at each stage.

In one test, the AI linked four Chrome vulnerabilities to escape the browser’s security sandbox and run code outside it. A demonstration opened the Calculator app on a Mac seconds after a malicious page loaded, without further user interaction. In Safari, another attack bypassed a security rule that prevents websites from accessing each other’s data, potentially exposing information from sites where a user was signed in.

The other demonstrations targeted Android, Windows and Linux. An Android exploit could extract photos and other data from a locked phone, but required physical access through USB. A Windows attack could repeatedly crash a server accepting HTTP/3 requests, though it could not run code or access stored data.

The Linux exploit went further, allowing an attacker to gain full administrator access to a server over a network without a login or user interaction. However, it required a specific networking configuration and would not work against every Linux system.

The company presents the findings as evidence that AI could help researchers find and fix vulnerabilities before attackers exploit them. The demonstrations also highlight the risks of models that can turn separate security flaws into complete attacks. These were lab tests, however, not evidence that the exploit chains had been used in real-world attacks.