Claude AI Autonomously Discovers and Chains Zero-Day Vulnerabilities Across Major Platforms
Anthropic revealed that an unreleased internal Claude research model autonomously discovered multiple vulnerabilities and chained them into five working attack vectors across Chrome, Safari, Android, Windows, and Linux. Notably, the model achieved a Linux root exploit in 53 minutes and uncovered 62 CVEs for Google Chrome. This demonstrates a major leap in AI-driven cybersecurity, shifting AI capabilities from basic code assistance to autonomous vulnerability research and exploit chaining across complex operating systems. It highlights both the immense defensive urgency to audit software and the growing offensive potential of advanced language models. The discovered vulnerabilities include a Linux zero-click kernel remote code execution flaw and an Android exploit bypassing lock screens on Pixel 9 devices via USB. All identified vulnerabilities have been responsibly disclosed and patched by the respective vendors.
## BACKGROUND
Sandbox escape allows malicious code to break out of a restricted execution environment to access the underlying system, while use-after-free refers to a memory safety bug where a program continues using a pointer after freeing its memory. The same-origin policy is a crucial web security concept that restricts how scripts on one website can access data from another.