Security: an Anthropic AI built attacks against Chrome, Windows and Linux, should we be worried?

You open a web page in Chrome, on a perfectly ordinary Mac. A few seconds later, Calculator opens all by itself. You didn't click anything else. Calculator is the classic joke among security researchers: it proves they could have launched any program on your machine. And this attack wasn't written by a human. It's an AI from Anthropic, not yet released, which found four vulnerabilities in Chrome and chained them together all by itself.

Anthropic's security team, the one that tests what its own models know how to do dangerously, published five complete attacks made this way on October 27: against Chrome, Safari, Android, Windows and Linux. And before you panic, remember this first: all the vulnerabilities were reported to the vendors and fixed before publication.

Five padlocks, one for each system: Chrome, Safari, Android, Windows and Linux

What's an exploit chain?

A single vulnerability often isn't enough. Modern software is built like a well-protected house: a gate, a dog, closed windows. Each small mistake opens just one door. An attacker's job is to find the badly closed gate, THEN the moment when the dog is asleep, THEN the window left ajar, and chain them together in the right order. That's what's called an exploit chain, and until now it was the work of a few teams of experts around the world, paid very well, over several weeks.

Gate open, dog asleep, window ajar: three little mistakes, and we're in

In Chrome, the AI chained four of them together. The first two affected the engine that runs the code in web pages. The third revealed where the browser's important pieces were stored in memory. The fourth made it possible to escape the “sandbox”, that locked room where Chrome confines each page so it can't touch the rest of your computer. Result: all it took was visiting a page, a single click, for it to take control of the Mac.

Chrome's sandbox works on the same idea: the web page plays in it, and it must never get out

The five attacks, without the jargon

Here's what the AI made, according to Anthropic:

• Chrome on Mac: a booby-trapped page takes control of the computer in one click, the one that opens the page;
• Safari: a booby-trapped page could read the history, cookies and open sessions, so potentially your mailbox or your bank if you were logged in, without even needing to launch a program;
• Android: on a locked Pixel 9, plugged in over USB, it retrieved photos and personal data, so you had to have the phone in your hand;
• Windows: a few carefully chosen packets sent over the Internet crashed a web server, and all it took was doing it again to keep it down;
• Linux: the most serious one, taking full control of a remote server, without any click. According to Anthropic, the AI took three quarters of an hour for the first step, and just five more minutes to get control.

For Chrome, the work was extensive: Google assigned 62 vulnerability numbers to this campaign according to Anthropic, all classified as serious or critical, and all fixed in Chrome 156. Google's release notes even thank “Xinyang Ge (Anthropic), assisted by Claude” in black and white. For Windows, Anthropic estimates the number of exposed servers at several million.

Why this is actually good news

It may seem strange to say that about a machine that pulls off burglaries. But look at the order of events. The AI finds them, the team checks every discovery by hand, notifies Google, Apple, Microsoft and the Linux people, gives them three months to fix things, then another month and a half before telling the details, according to the schedule published with the report. The criminals arrive after the battle. These flaws existed, some of them for a long time, and now they are closed.

A week ago, I was telling you that OpenAI and Google AIs had found two flaws in PHP, the engine behind seven out of ten websites. Same trend: the biggest software on the planet is being combed through by machines that never sleep, and holes that nobody had seen for years are being plugged. To me, this is very good news for the security of our computers and phones.

The downside, because there is one

If an Anthropic AI knows how to do this, others will know how too. At the end of September, the same team also explained that GLM-5.3, a Chinese model, can also build complete attacks, and that it was released without any real safeguards. The day a hacker gets this kind of tool, the time between discovering a flaw and attacking it will shrink. The burglar from earlier will not even need to wait for the dog to fall asleep.

And we need to keep one eyebrow raised about the figures. The model has no name, nobody from outside saw the instructions given to the AI or its drafts, and Anthropic talks about attacks written « after an initial instruction » without detailing the human work at each stage. Analysts also noted that two of the five descriptions do not line up perfectly with the public records of the flaws: for Windows, Microsoft talks about a different component from the one cited by Anthropic. The fixes are very real, and Google, Apple and Microsoft all credit Anthropic's team with Claude.

What you do tonight, in five minutes

The best defense against this kind of attack is updating. Not tomorrow, not « when I have time ».

• Chrome: type chrome://settings/help in the address bar, it looks for and installs the update, then click « Relaunch ». You must be on version 156 or later ;
• iPhone and Mac: Settings, General, Software Update, and install whatever is waiting ;
• Android: in Settings, search for « update » and install both the system update and the Google Play system update ;
• Windows: Settings, Windows Update, and let it restart.

The most effective defense against an AI that chains flaws together fits in a coffee

If you have a Linux server, at home or at work, check that its kernel received the mid-October patches. And if you are a developer, Anthropic recommends having an AI review your code after every change, before it goes into production, so that new flaws do not join the pile of old ones. I already do this with Claude Code at the end of every project, and it finds things I would have sworn I had checked.

In short, AI opens locks faster than we do. We might as well have it do that at our place, for us, before anyone else. And to all those who have been putting off the Chrome update for three weeks because they have 47 tabs open: it reopens them all by itself, promise!

Sources

• Anthropic's Frontier Red Team, October 27, 2026: « Discovering and exploiting vulnerabilities in critical, real-world software with Claude »
• Cyber Security News, October 28, 2026: the details of the five chains
• DEV Community: what the public records of the flaws confirm, and what they do not confirm
• GBHackers: Anthropic's advice to security teams

Article written with the help of Claude Code, reread and corrected by me.