Anthropic's Frontier Red Team said an unreleased internal research model found security flaws in Chrome, Safari, Android, Windows and Linux and chained them into working proof-of-concept exploits, all reported to vendors beforehand and already patched. One chain opened the Calculator app on a stock Mac running Chrome within seconds of a page load, with no further clicks. Anthropic's claim — that a single model assembled several separate flaws into a working exploit, work previously the preserve of specialist teams — rests on the company's own account; it says the work required only "initial prompting" and "little human involvement" without naming the model or breaking down human input at each step, though vendor credit for specific fixes is verifiable. Apple and Google credit Claude in patch notes. The step-change signal for defenders: autonomous vulnerability-chaining is nearing the point where disclosure timelines, not exploit rarity, become the pacing element of exposure.

• Source article