Claude Research Model Finds Vulnerabilities Across Five Major Platforms
Anthropic reported that an unpublished internal Claude research model autonomously identified vulnerabilities and wrote exploit code across Chrome, Safari, Android, Windows, and Linux, producing five runnable attack chains. The Chrome report reportedly yielded 62 critical or high-severity CVEs, while the Linux chain CVE-2026-98432 was validated in 53 minutes and reached a root shell on a server running a multipath TCP listener. Anthropic said the vulnerabilities were disclosed through coordinated disclosure and fixed by the relevant vendors.
The report presents a significant instance of Claude-assisted vulnerability research and exploit chaining across widely used browsers, operating systems, and servers, although the model's identity and performance figures remain vendor-reported.
IT之家 10 月 29 日消息，Anthropic 于 10 月 27 日发布研究报告，称其通过一个未公开发布的内部 Claude 研究模型，在 Chrome、Safari、Android、Windows 和 Linux 中发现漏洞，并将多个漏洞串联为 5 条可实际运行的攻击链。相关漏洞均已按协调披露流程报告厂商并修复。
其中最受关注的是 Chrome，IT之家援引博文介绍，Anthropic 向谷歌提交的报告共产生 62 个严重或高危 CVE，包括 13 个沙箱逃逸漏洞和 21 个可控制网页渲染进程的漏洞，修复已随 Chrome 156 发布。
研究团队称，Claude 在研究人员给出初始提示后，自主定位漏洞并编写利用代码；其 Chrome 概念验证可在页面加载后数秒内于 macOS 默认安装环境中打开计算器应用。
Safari 方面，Claude 发现的漏洞链可绕过同源策略，让恶意网站有机会读取用户已登录账号的数据；苹果已在同日确认并发布修复。Android 攻击则需物理接触设备，可在 Pixel 9 锁屏状态下通过 USB 提取照片等个人数据，谷歌称已处理该问题。
#Anthropic#Claude#Chrome 156#Google Chrome#Apple Safari#Android#Windows#Linux#Pixel 9#Google#Apple#Microsoft