Anthropic: نموذج داخلي من Claude لقى ثغرات خطيرة في Chrome وSafari وAndroid وWindows وLinuxAnthropic says an internal Claude model found critical flaws in Chrome, Safari, Android, Windows and Linux

Anthropic says that over the past few months it used an unreleased internal research model to look for critical vulnerabilities in software used by billions of people, such as browsers and operating systems. It published details of 5 attack chains that work with little to no user interaction.

The headline case is Chrome: Claude wrote a full exploit chain that lets a web page run code on the user's computer outside the browser's sandbox, within seconds of the page loading. Anthropic says its Chrome findings have been assigned 62 CVEs (an official number for each vulnerability), all patched as of Chrome 156 and all rated critical or high severity.

In Safari it found a way for any website to read sensitive data such as browsing history and cookies; Apple fixed it promptly and the fix is available. On Android it could pull photos and personal information from a stolen phone without unlocking it, which Google has addressed. In Windows it found a flaw that let an attacker remotely crash Windows machines responding to HTTP/3 requests, which Microsoft resolved. In Linux, a flaw allowed commands to run with full privileges on some servers, and it has been patched.

Anthropic reported the flaws to the vendors, and its policy gives them 90 days to patch before publication. It says these skills used to belong to a few specialist teams, but models can now do this with little human involvement, and its advice to defenders is that scanning your own code matters more than ever.