Anthropic'ning chiqarilmagan AI modeli Chrome, Safari, Android, Windows va Linux'dagi xavfsizlik xatoliklarini topdi va ularni ishlaydigan proof-of-concept eksploitlarga birlashtirdi, deb xabar berdi kompaniya o'zining so'nggi hisobotida.
Eksploitlar model so'ralgandan keyin laboratoriyada qurilgan, hech qanday haqiqiy hujumda ko'rilmagan va Anthropic har bir xatolikni avval sotuvchiga xabar qilgan, shuning uchun ularning barchasi allaqachon tuzatilgan. Bir proof-of-concept Chrome ishlatayotgan stock Mac'da sahifa yuklanishidan bir necha soniya ichida, boshqa hech qanday bosishsiz, Kalkulyator ilovasini ochdi.
Anthropic'ning Frontier Red Team tadqiqot postida beshta zanjirni tasvirladi. Eng kuchli da'vo har qanday bitta xato emas, balki bitta model bir nechta alohida xatoliklarni topib, ularni ishlaydigan eksploitga birlashtirgani — bu kompaniya aytishicha, hozirgacha faqat bir nechta mutaxassis jamoalarning ishi bo'lgan. Bu qobiliyat da'vosi Anthropic'ning o'z hisobiga asoslanadi.
Tuzatishlar va Apple hamda Google Anthropic va uning Claude modelini aniq tuzatishlar uchun kredit berishi sotuvchilar bilan tekshirilishi mumkin.
O'quvchi tekshira olmaydigan narsa — har bir zanjirning qanchalik qismini model o'zi qurdi. Anthropic ish faqat "dastlabki so'rov" va "kam inson ishtiroki"ni talab qilganini aytadi, lekin u har bir qadamda inson nima qilganini ajratmaydi va modelni faqat chiqarilmagan, ichki tadqiqot modeli deb atashdan tashqari nomlamaydi.
O'zining ochiq yozuvi bo'lgan yagona xato — Windows xatosi — yozuvda hech qanday topuvchi nomlanmagan. Mana beshta zanjir, har biri nima qiladi, har biri qanday shartni talab qiladi va tuzatish qayerda joylashgan.
| Platforma | Eksploit nima qiladi | Talab qiladigan shart | Tuzatish |
|---|---|---|---|
| Chrome | Kompyuterda, brauzerning sandbox'idan tashqarida, bitta veb-sahifa tashrifidan kodni ishga tushiradi | Bitta bosish yoki sahifa yuklanishi, macOS'dagi stock Chrome | Chrome 156, 20-oktabr |
| Safari | Foydalanuvchi kirgan boshqa saytlar, masalan elektron pochta yoki bank hisobi ma'lumotlarini har qanday veb-sayt o'qishiga ruxsat beradi | Zararli sahifaga bitta tashrif | iOS va iPadOS 26.5.2, 29-iyun |
| Android | Qulflangan, o'g'irlangan telefondan fotosuratlar va boshqa ma'lumotlarni nusxalaydi | Telefonni jismoniy qo'lda ushlash, USB orqali | Anthropic Google tuzatganini aytadi; ochiq yozuv topilmadi |
| Windows | Tarmoq orqali serverni ishdan chiqaradi va takrorlash orqali uni pastda ushlab turadi | Server HTTP/3 so'rovlariga javob beradi | CVE-2026-33096, 2026-yil aprelida tuzatilgan |
| Linux | Tarmoq orqali, kirishsiz va foydalanuvchi harakatisiz, root sifatida buyruqlarni ishga tushiradi | Server multipath TCP tinglovchisini ishga tushiradi | CVE-2026-98432, 15-oktabrda tuzatilgan |
Chrome zanjirida model to'rtta alohida xatolikni ketma-ket ishlatdi. Zararli sahifa avval Chrome'ning JavaScript dvigateli V8'dagi xotirani buzdi.
Ikkinchi xato V8'ning xotira sandbox'idan qochib, sahifani render qiladigan Chrome qismini nazoratga oldi. CacheStorage deb nomlangan funksiyadagi poyga sharti (race condition) bu kodga u yetmasligi kerak bo'lgan xotirani o'qishga va yuqori huquqli brauzer jarayonining joylashuvini o'rganishga imkon berdi.
FedCM'dagi, Chrome'ning kirish funksiyasidagi, yakuniy use-after-free xatosi eksploitga sandbox'dan butunlay tashqarida kodni ishga tushirishga ruxsat berdi. Anthropic Google'ga 62 ta xatolikni xabar qilganini aytadi, ular CVE'lar bilan belgilangan va Chrome 156'dan boshlab tuzatilgan, barchasi kritik yoki yuqori darajada baholangan, shu jumladan 13 ta sandbox qochishi.
Google'ning o'z reliz eslatmalari "Anthropic'dan Xinyang Ge, Claude yordamida" deb aniq Chrome tuzatishlari uchun kredit beradi, lekin 62 ta xatolikning barchasi uchun emas.
Safari zanjiri boshqacha, chunki u hech qachon kodni ishga tushirmaydi. U xatoliklarni zanjirlab, brauzer xotirasiga to'liq o'qish va yozish huquqini oladi, so'ngra bitta qiymatni o'zgartirib, bir veb-sayt boshqa veb-sayt ma'lumotlarini o'qishiga to'sqinlik qiladigan same-origin siyosatini o'chiradi.
Bu qoida o'chirilgach, zararli sahifa foydalanuvchining tarixini va cookie'larini o'qishi va boshqa saytlarga kirgan so'rovlarni yuborishi mumkin. Apple zanjirning markazidagi use-after-free xatosini iOS va iPadOS 26.5.2'da tuzatdi va "Milad Nasr va Nicholas Carlini Claude bilan, Anthropic" deb kredit beradi.
Windows zanjiri mustaqil qog'oz izi bo'lgan yagona zanjir va u eng tor. Bu xizmatni rad etish hujumi (denial-of-service): bir nechta tarmoq paketlari mashinani ishdan chiqaradi va ularni takrorlash uni pastda ushlab turadi, lekin u kodni ishga tushirmaydi yoki ma'lumot o'g'irlamaydi. Anthropic xatolikni Windows yadrosining QUIC ishlovidagi chegaradan tashqari o'qish (out-of-bounds read) deb tasvirlaydi.
U ko'rsatgan xato uchun ochiq yozuv, CVE-2026-33096, o'rniga HTTP.sys, Windows'ning o'rnatilgan veb-so'rov ishlovchisini nomlaydi va uni 10 dan 7.5 deb baholaydi. Hech qanday ochiq manba bu ikki tasvirni bir xil komponent deb bog'lamaydi. CVE yozuvi hech qanday topuvchini kredit bermaydi, shuning uchun Anthropic'ning bu xato muallifligi faqat o'z postiga asoslanadi.
Oktyabr oxirida AQSh hukumatining zaiflik boyitishi xatolikni ishlatilmagan deb belgiladi va u CISA'ning ma'lum ishlatilgan xatoliklar katalogida emas edi.
Linux zanjiri ta'sir jihatidan eng jiddiy: u tarmoq orqali kirishsiz root sifatida buyruqlarni ishga tushiradi. U maqsad server multipath TCP tinglovchisini ishga tushirishini talab qiladi. Model avval KASLR deb nomlangan himoyani chetlab o'tish uchun yadro xotira manzilini sizdiradi, so'ngra hujumchi allaqachon joylashtirgan kodga dastur yo'naltirish uchun xuddi shu poyga sharti xatosini qayta ishlatadi, natijada root shell hosil bo'ladi.
Anthropic o'z proof-of-concept'i manzilni sizdirish uchun 48 daqiqa va shell'ga yetish uchun yana besh daqiqa olganini va muvaffaqiyatsiz urinish tizimni ishdan chiqarmasligini, shuning uchun hujumchi qayta urinishni davom ettirishi mumkinligini aytadi.
Kompaniya bu zanjirni CVE-2026-98432 bilan bog'laydi, bu 9.8 deb baholangan va 15-oktabrda yuqori oqimda tuzatilgan yadro use-after-free; bu CVE uchun ochiq yozuv IPv4 TCP tuzatishini tasvirlaydi, multipath TCP emas, va ikkalasi faqat Anthropic'ning posti bilan bog'langan.
Anthropic ishni himoyachilar uchun yordam sifatida taqdim etadi. U har bir xatolikni muvofiqlashtirilgan oshkor qilish siyosati ostida xabar qilganini aytadi, bu ishlab chiquvchilarga tuzatish uchun 90 kun va ochiq maslahatdan tashqari tafsilotlarni muhokama qilishdan oldin yana 45 kun beradi va xavfsizlik jamoalarini kengaytirilgan Cyber Verification Program'iga yo'naltiradi, bu tasdiqlangan mutaxassislarga Claude Opus 5.5, Sonnet 5.5 va Mythos 5.1'ga kirish beradi.
Kompaniya nashr qilish sababini o'z so'zlari bilan aytadi: "Endi bu modellar kam inson ishtiroki bilan qila oladigan narsa, va keyin har kim ishga tushirishi va tekshirishi mumkin bo'lgan ishlaydigan eksploit ishlab chiqarish orqali isbotlanadi."
An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report.
The exploits were built in the lab after the model was prompted, not seen in any real attack, and Anthropic reported every flaw to the vendor first, so all of them are already patched. One proof of concept opened the Calculator app on a stock Mac running Chrome within seconds of a page loading, with no further clicks.
Anthropic's Frontier Red Team described five chains in a research post. The strongest claim is not any single bug, but that one model found several separate flaws and combined them into a working exploit, something the company says has until now been the work of a few specialist teams. That capability claim rests on Anthropic's own account.
The patches and the fact that Apple and Google credit Anthropic and its Claude model for specific fixes can be verified with the vendors.
What a reader cannot check is how much of each chain the model built on its own. Anthropic says the work needed only "initial prompting" and "little human involvement," but it does not break down what a person did at each step, and it does not name the model beyond calling it an unreleased, internal research model.
For the one flaw with its own public record, the Windows bug, the record names no finder at all. Here are the five chains, what each would do, the condition each needs, and where the fix landed.
| Platform | What the exploit does | Condition it needs | Fix |
|---|---|---|---|
| Chrome | Runs code on the computer, outside the browser's sandbox, from one visit to a web page | One click or page load, stock Chrome on macOS | Chrome 156, October 20 |
| Safari | Lets any website read data from other sites the user is signed in to, such as email or a bank account | One visit to a malicious page | iOS and iPadOS 26.5.2, June 29 |
| Android | Copies photos and other data off a locked, stolen phone | Physical access to the phone, over USB | Anthropic says Google has fixed it; no public record was found |
| Windows | Crashes a server over the network, and keeps it down by repeating | The server answers HTTP/3 requests | CVE-2026-33096, patched April 2026 |
| Linux | Runs commands as root over the network, with no login and no user action | The server runs a multipath TCP listener | CVE-2026-98432, patched October 15 |
In the Chrome chain, the model used four separate flaws in turn. A malicious page first corrupted memory in V8, Chrome's JavaScript engine.
A second flaw escaped V8's memory sandbox and took control of the part of Chrome that renders the page. A race condition in a feature called CacheStorage then let that code read memory it should not reach and learn the layout of the more privileged browser process.
A final use-after-free bug in FedCM, Chrome's sign-in feature, let the exploit run code outside the sandbox entirely. Anthropic says it reported 62 flaws to Google that were assigned CVEs and fixed as of Chrome 156, all rated critical or high, including 13 sandbox escapes.
Google's own release notes credit "Xinyang Ge of Anthropic, assisted by Claude" for specific Chrome fixes, though not for all 62.
The Safari chain is different because it never runs code at all. It chains flaws to obtain full read and write access to the browser's memory, then changes a single value to turn off the same-origin policy, the rule that prevents one website from reading another's data.
With that rule off, a malicious page can read a user's history and cookies and send signed-in requests to other sites. Apple fixed the use-after-free at the center of the chain in iOS and iPadOS 26.5.2 and credits "Milad Nasr and Nicholas Carlini with Claude, Anthropic" for it.
The Windows chain is the one with an independent paper trail, and it is also the narrowest. It is a denial-of-service attack: a few network packets crash the machine, and repeating them keeps it down, but it does not run code or steal data. Anthropic describes the flaw as an out-of-bounds read in the Windows kernel's QUIC handling.
The public record for the bug it points to, CVE-2026-33096, instead names HTTP.sys, Windows' built-in web request handler, and rates it 7.5 out of 10. No open source ties those two descriptions together as the same component. The CVE record credits no finder, so Anthropic's authorship of this one rests on its own post.
As of late October, the U.S. government's vulnerability enrichment marked the flaw as not exploited, and it was not in the CISA catalog of known exploited bugs.
The Linux chain is the most serious in terms of impact: it runs commands as root over the network without a login. It needs the target server to be running a multipath TCP listener. The model first leaks a kernel memory address to bypass a defense called KASLR, then reuses the same race-condition bug to redirect the program to code the attacker has already placed, resulting in a root shell.
Anthropic says its proof of concept took 48 minutes to leak the address and five more to reach the shell, and that a failed attempt does not crash the system, so an attacker can keep retrying.
The company ties this chain to CVE-2026-98432, a kernel use-after-free rated 9.8 and fixed upstream on October 15; the public record for that CVE describes an IPv4 TCP fix rather than a multipath TCP one, and the two are linked only by Anthropic's post.
Anthropic frames the work as help for defenders. It says it reported each flaw under a coordinated disclosure policy that gives developers 90 days to patch and 45 more before it discusses details beyond a public advisory, and it points security teams to its expanded Cyber Verification Program, which gives vetted professionals access to Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1.
The reason the company gives for publishing is in its own words: "Now, it's something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
