EN PT-BR
← Voltar ao feed
high

Anthropic's unreleased Claude model chained flaws into working Chrome, Safari, Android, Windows and Linux exploits; all reported and patched

3 fonte(s) · 3 atualização(ões) · publicado 28/10/2026 05:15 · coletado há 3 dias

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 30/10/2026 00:10; os links antigos trazem para cá.

Fontes: darkreading.com ↗ gbhackers.com ↗ thehackernews.com ↗

Anthropic's Frontier Red Team disclosed on October 27, 2026 that an unreleased research model, described as a version of Claude, found security flaws in Chrome, Safari, Android, Windows and Linux and chained them into five working proof-of-concept exploits (thehackernews.com, gbhackers.com, darkreading.com). Every flaw was reported to the vendor before publication, the exploits were built in the lab and not seen in real attacks, and the flaws are reported as patched (thehackernews.com). The most serious is a Linux chain giving unauthenticated remote root command execution on hosts with a multipath TCP listener, tied by Anthropic to CVE-2026-98432 (gbhackers.com). The central claim is that one model can find and combine several separate bugs with little human involvement. This rests on Anthropic's own account, and thehackernews.com notes that the human role at each step is not broken down and the model is not named. Darkreading.com frames the disclosure as a dual-use milestone that shortens the window between patch and weaponization. No indicators of compromise or exploit code were published (darkreading.com).

Entenda a falha

A vulnerabilidade

Anthropic says an unreleased research model chained flaws into five lab proof-of-concept exploits. All were reported to vendors and are reported as patched. The worst is a Linux chain tied by Anthropic to CVE-2026-98432 (kernel use-after-free, CVSS 9.8, fixed upstream October 15, patched in all maintained stable kernels per gbhackers.com). It gives unauthenticated remote root command execution on hosts with a multipath TCP listener. The Chrome chain (fixed in Chrome 156) combines a V8 memory corruption, a V8 sandbox escape, a CacheStorage race and a FedCM use-after-free. The Safari chain disables the same-origin policy (fixed in iOS/iPadOS 26.5.2). On a locked Pixel 9, an Android chain extracts data over USB. CVE-2026-33096 (7.5) is a Windows remote denial of service via a few packets to an HTTP/3 server.

Como funciona

In the Linux chain, a remote attacker reaches a multipath TCP listener and triggers a race condition that becomes a use-after-free in the kernel networking stack. The exploit first leaks a kernel address to defeat KASLR (48 minutes in Anthropic's test), then reuses the race to overwrite a callback pointer and run a command as root (about five more minutes). Failed attempts do not crash the system, so retries are possible. In Chrome, a malicious page corrupts V8 memory, escapes the V8 sandbox and defeats ASLR. The CacheStorage race reveals the privileged process layout and the FedCM use-after-free breaks out of the sandbox. In Safari, memory read/write is used to change a security flag, an object size and a URL, without running code. On the Pixel 9, three flaws skip the USB data block, the pairing authorization and the six-digit code check, then a fallback path sends raw file bytes. On Windows, a few packets crash and restart an HTTP/3 server.

Por que é vulnerável

The articles give root causes only as bug classes: use-after-free (Chrome FedCM, Safari, Linux), race conditions (CacheStorage and the Linux kernel), memory corruption in V8, and an out-of-bounds read in Windows kernel QUIC handling (per Anthropic). On Android, the causes are missing checks on the USB data block, pairing authorization and the six-digit code. The chains work because separate bugs combine: one leaks layout or defeats ASLR/KASLR and another gives control. The articles do not explain why the bugs went unnoticed or what the fixes change in the code.

Onde está

The articles name only components: V8, CacheStorage and FedCM in Chrome; HTTP.sys (CVE record) or kernel QUIC handling (Anthropic) in Windows; multipath TCP in the Linux kernel. No files, functions or commits are given, and the public CVE-2026-98432 record describes an IPv4 TCP fix, not multipath TCP.

Como foi descoberta

Anthropic's Frontier Red Team says an unreleased research model found and chained the flaws with initial prompting and little human involvement, published October 27, 2026. The articles do not break down what humans did and the model is not named. Anthropic reported everything to vendors under a 90-day patch window plus 45 days before more detail, and nothing was seen in real attacks. Google credits Xinyang Ge of Anthropic, assisted by Claude, for specific Chrome fixes, not all 62 CVEs. Apple credits Milad Nasr and Nicholas Carlini with Claude and, per gbhackers.com, acknowledged the report the same day. gbhackers.com says the Windows bug was found by reverse engineering with tools such as Ghidra. The CVE-2026-33096 record credits no finder. Darkreading.com says no specific CVEs were reported, contradicting the other two outlets. The links to the public CVEs rest on Anthropic's post.

Explicação gerada por IA a partir da matéria e dos artigos, em 30/10/2026 00:26.

Detalhes técnicos

  • Chrome: four chained flaws: a V8 memory corruption, a V8 memory sandbox escape that also defeats ASLR, a CacheStorage race condition that leaks the layout of the privileged process, and a use-after-free in FedCM that gives the final sandbox escape (thehackernews.com, gbhackers.com). One PoC opened Calculator on a Mac seconds after page load with no clicks. Anthropic reports 62 CVE-assigned flaws fixed as of Chrome 156, 13 of them sandbox escapes (thehackernews.com, gbhackers.com). Google credits "Xinyang Ge of Anthropic, assisted by Claude" for specific fixes (thehackernews.com).
  • Safari: the chain gives read/write access to browser memory and then changes a single value to disable the same-origin policy, exposing history, cookies and signed-in sessions to other sites (thehackernews.com). It did not run arbitrary code; it only changed a security flag, an object size and a URL (gbhackers.com). Apple acknowledged the report the same day (gbhackers.com) and fixed the central use-after-free in iOS and iPadOS 26.5.2, crediting "Milad Nasr and Nicholas Carlini with Claude, Anthropic" (thehackernews.com).
  • Android: three flaws chained on a locked Google Pixel 9 bypass the USB data block, the pairing authorization check and the six-digit code check. A fallback path then sends raw file bytes over USB to extract photos and personal data. Google has fixed it (gbhackers.com).
  • Windows: a denial-of-service via a few network packets, which can crash and restart a server answering HTTP/3 requests, tracked as CVE-2026-33096. Anthropic estimates several million such servers are internet-facing, and says the model found the bug by reverse engineering the binary with tools such as Ghidra (gbhackers.com). It was not marked exploited and was not in the CISA KEV catalog as of late October (thehackernews.com).
  • Linux: a race condition leads to a kernel networking use-after-free. The exploit leaks a kernel address to bypass KASLR (48 minutes in the test), then overwrites a callback pointer to run a shell command as root in about 5 more minutes. Failed attempts do not crash the system, so retries are possible (thehackernews.com, gbhackers.com). Anthropic ties it to CVE-2026-98432 (kernel use-after-free, CVSS 9.8, fixed upstream October 15) (thehackernews.com).
  • Scale: Anthropic's partners found at least 129,000 verified flaws between April and July 2026 (gbhackers.com).

Remediação

  • Apply current vendor patches: Chrome 156 or later, iOS/iPadOS 26.5.2 or later, the Windows update for CVE-2026-33096, the Android fix from Google, and the kernel fix for CVE-2026-98432 (patched in all maintained stable kernels, per gbhackers.com) (thehackernews.com, gbhackers.com).
  • Shorten patch cycles for browsers and operating systems, and assume less time between disclosure and exploitation (darkreading.com).
  • Invest in exploit-mitigation hardening such as memory-safety features, sandboxing and browser isolation, rather than relying on patch speed alone (darkreading.com).
  • Anthropic recommends parallel scanning agents and scanning at pull-request time (gbhackers.com). It follows a 90-day patch window plus 45 days before detailed disclosure (thehackernews.com).
  • Add AI-assisted offensive capability to threat models and follow AI vendor safety disclosures (darkreading.com).

Relatos divergentes

  • CVE disclosure: darkreading.com (the most recent source, October 29) says no specific CVEs were reported. This is contradicted by thehackernews.com and gbhackers.com, which cite CVE-2026-33096, CVE-2026-98432 and 62 Chrome CVEs.
  • Windows component: Anthropic describes an out-of-bounds read in kernel QUIC handling (thehackernews.com, gbhackers.com). The public record for CVE-2026-33096 names HTTP.sys, rates it 7.5 and credits no finder, and no open source ties the two descriptions to the same component (thehackernews.com). The link is unverified.
  • Linux component: Anthropic describes CVE-2026-98432 as a multipath TCP issue, but the public record describes an IPv4 TCP fix, not multipath TCP (thehackernews.com).
  • Chrome attribution: Anthropic claims all 62 CVEs, but Google's credit to Anthropic covers only specific fixes (thehackernews.com).
  • Autonomy: darkreading.com says the model worked autonomously. Thehackernews.com says the human role at each step is not disclosed and the key claim rests only on Anthropic's account.

Linha do tempo

  1. darkreading.com ↗ · pub. 29/10/2026 15:15 · coletado 29/10 16:00 só resumo do feed

    Anthropic says unreleased Claude model autonomously discovered and chained exploits in Chrome, Safari, Android, Windows and Linux

    ler a análise desta fonte

    Anthropic disclosed that an unreleased version of its Claude model was able to autonomously discover and chain multiple vulnerabilities across major platforms, including Google Chrome, Apple Safari, Android, Windows and Linux. According to the company, the model moved beyond single bug discovery to building working exploit chains, a capability threshold that materially lowers the cost of offensive operations. The disclosure is framed as a dual-use milestone: the same capability can accelerate defensive vulnerability research and patching, but also empowers less-skilled attackers. No specific CVEs, victims or in-the-wild abuse were reported in the article. Defenders should treat this as a signal that AI-assisted exploit development is maturing, shortening the window between patch release and weaponization.

    Technical Details

    • The model reportedly performed vulnerability discovery and exploit chaining across browsers and operating systems rather than isolated proof-of-concept bugs.
    • Platforms cited: Chrome, Safari, Android, Windows, Linux.
    • The model version involved is unreleased, and no indicators of compromise or exploit code were published.

    Remediation

    • Compress patching cycles for browsers and OS platforms; assume reduced time-to-exploit after disclosure.
    • Invest in exploit-mitigation hardening (memory-safety features, sandboxing, browser isolation) rather than relying on patch latency.
    • Monitor AI vendor safety disclosures and incorporate AI-assisted offensive capability into threat models.
  2. gbhackers.com ↗ · pub. 28/10/2026 09:51 · coletado 28/10 10:00

    Anthropic's unreleased Claude model chains flaws into working exploits for Chrome, Safari, Android, Windows and Linux

    The article adds detail not in the known report: the Safari chain works by changing only a security flag, an object size and a URL, and Apple acknowledged it the same day; the Android chain on a locked Pixel 9 (three bypasses plus a USB fallback path, fixed by Google); the Windows flaw was found by reverse engineering with Ghidra and Anthropic estimates several million exposed HTTP/3 servers; the Linux CVE-2026-98432 is patched in all maintained stable kernels; partners found at least 129,000 verified flaws between April and July 2026; and Anthropic recommends parallel scanning agents and pull-request-time scanning.

    ler a análise desta fonte

    The article adds detail not in the known report: the Safari chain works by changing only a security flag, an object size and a URL, and Apple acknowledged it the same day; the Android chain on a locked Pixel 9 (three bypasses plus a USB fallback path, fixed by Google); the Windows flaw was found by reverse engineering with Ghidra and Anthropic estimates several million exposed HTTP/3 servers; the Linux CVE-2026-98432 is patched in all maintained stable kernels; partners found at least 129,000 verified flaws between April and July 2026; and Anthropic recommends parallel scanning agents and pull-request-time scanning.

    Anthropic's Frontier Red Team disclosed on October 27, 2026 that an unreleased research model, Claude, developed working exploit chains against Chrome, Safari, Android, Windows and Linux, several needing little or no user interaction. Every flaw was reported to the affected vendor before publication. The most serious is a zero-click Linux chain that gives a remote, unauthenticated attacker root command execution on servers with a multipath TCP listener (CVE-2026-98432). The article stresses speed: skills once limited to a few expert teams can now be performed with little human help, and the same capability can aid attackers.

    Technical Details

    • Chrome: a V8 bug corrupts heap memory, a second flaw escapes the V8 memory sandbox and defeats ASLR, a CacheStorage race condition reveals the privileged process layout, and a use-after-free in FedCM gives the final sandbox escape. A PoC opened Calculator on macOS seconds after page load. Google assigned 62 CVEs, 13 of them sandbox escapes, all fixed in Chrome 156.
    • Safari: the chain lets any website bypass the same-origin policy, exposing history, cookies and logged-in sessions. It did not run arbitrary code; it only changed a security flag, an object size and a URL in memory. Apple acknowledged the report the same day and has shipped a fix.
    • Android: three flaws chained on a locked Google Pixel 9 skip the USB data block, the pairing authorization check and the six-digit code check, then a fallback path sends raw file bytes over USB to extract photos and personal data. Google has fixed it.
    • Windows: remote crash bug in kernel QUIC code (CVE-2026-33096). A few packets can crash and restart a server answering HTTP/3 requests. Anthropic estimates several million such servers face the internet. Claude found it by reverse engineering the binary with tools such as Ghidra.
    • Linux: a race condition leading to a kernel networking use-after-free. The exploit leaks a kernel address to defeat KASLR (48 minutes in the test), then overwrites a callback pointer and runs a shell command as root in about five more minutes. Failed attempts do not crash the system, so retries are possible. CVE-2026-98432 is patched in all maintained stable kernels.
    • Anthropic's partners found at least 129,000 verified flaws between April and July 2026. Earlier this year a researcher showed Claude Opus helping build a working V8 exploit against an outdated Chromium build in Discord Desktop.

    Remediation

    • Apply current patches: Chrome 156 or later, the Apple Safari fix, the Pixel update, the Windows fix for CVE-2026-33096 and a patched stable Linux kernel for CVE-2026-98432.
    • Run many different scanning agents in parallel and scan code at pull request time. Anthropic released a free security-guidance plugin for Claude Code and is widening its Cyber Verification Program for vetted defenders.
  3. thehackernews.com ↗ · pub. 28/10/2026 05:15 · coletado 28/10 06:00 primeiro registro

    Anthropic's unreleased AI model chains flaws into working Chrome, Safari, Windows and Linux proof-of-concept exploits

    ler a análise desta fonte

    Anthropic's Frontier Red Team reported that an unreleased internal research model found security flaws in Chrome, Safari, Android, Windows and Linux and chained them into five working proof-of-concept exploits. The exploits were built in the lab after prompting, were not seen in real attacks, and every flaw was reported to the vendor first, so all are patched. The key claim is that one model can find and combine several separate bugs with little human involvement. This rests on Anthropic's own account, since the article notes it does not break down what humans did at each step or name the model. Vendor credits (Google, Apple) can be verified, but the links between Anthropic's descriptions and the public CVE records for the Windows and Linux chains rest only on Anthropic's post.

    Technical Details

    • Chrome: four chained flaws. A V8 memory corruption, a V8 memory sandbox escape, a CacheStorage race condition that leaks the layout of the privileged browser process, and a use-after-free in FedCM give code execution outside the sandbox. Anthropic says it reported 62 CVE-assigned flaws fixed as of Chrome 156 (all critical or high, including 13 sandbox escapes). Google credits "Xinyang Ge of Anthropic, assisted by Claude" for specific fixes, not all 62. One PoC opened Calculator on a Mac within seconds of page load, with no clicks.
    • Safari: chain gives full read/write access to browser memory, then flips one value to disable the same-origin policy, exposing history, cookies and signed-in requests to other sites. Apple fixed the central use-after-free in iOS and iPadOS 26.5.2, crediting "Milad Nasr and Nicholas Carlini with Claude, Anthropic".
    • Windows: a denial-of-service via a few network packets, described by Anthropic as an out-of-bounds read in kernel QUIC handling. The public record for CVE-2026-33096 names HTTP.sys, rates it 7.5, and credits no finder. No open source ties the two descriptions to the same component. It was not marked exploited and not in the CISA KEV catalog as of late October.
    • Linux: the most severe chain gives unauthenticated remote root command execution, requiring a target running a multipath TCP listener. It leaks a kernel address to bypass KASLR, then reuses the same race condition to redirect execution to attacker-placed code. Anthropic reports 48 minutes to leak the address and 5 more to reach a root shell, and failed attempts do not crash the system, so retries are possible. Anthropic ties it to CVE-2026-98432 (kernel use-after-free, 9.8, fixed upstream October 15), but the public record describes an IPv4 TCP fix, not multipath TCP.

    Remediation

    • Apply current vendor patches: Chrome 156 or later, iOS/iPadOS 26.5.2 or later, the Windows update for CVE-2026-33096, and the upstream Linux kernel fix for CVE-2026-98432.
    • Anthropic follows a 90-day patch window plus 45 days before detailed disclosure, and offers vetted professionals access through its expanded Cyber Verification Program.