The week in which AI found PHP2Shell is not over, and there is already a new example of the models' cyber capabilities. Anthropic's security team, the Frontier Red Team, published five attack chains on Tuesday that were built by an internal research model not yet released to the public. According to reports, the chains hit some of the most widely used systems in the world: the Chrome and Safari browsers, Android, Windows and Linux.
What the model found
According to The Hacker News, the most serious case is in Chrome: one-click remote code execution, fixed in version 156 on October 20. In one demonstration, a web page opened the Calculator app on a standard Mac within seconds of loading. On Linux it is remote code execution with no user action at all. On Android, a lock-screen bypass, and on Windows a flaw that lets an attacker crash a computer remotely. For Safari, descriptions in the reports differ, and Apple credits Anthropic for the fix.
"Only initial prompting"
According to Anthropic, the work required only "initial prompting" by the researchers, but the company did not detail how much human work went into each step. It stresses that all the flaws were reported to vendors under coordinated disclosure, with 90 days to fix and 45 more days before further details are published. According to most reports the flaws are already fixed, though not every source lists the patch status. The model itself was not named.
Why it is worrying and encouraging
In recent weeks we have seen OpenAI and Google models help uncover PHP2Shell, and now an Anthropic model is building complete exploits for the world's most common systems. On one hand, it is a powerful tool for defenders, who can find and fix flaws faster than ever. On the other, similar models in the wrong hands could greatly shorten the time it takes attackers to build cyber weapons.
The takeaway for users and organizations is simple: security updates can no longer wait. The gap between discovering a flaw and exploiting it keeps shrinking, and anyone who updates their browser, operating system and phone late is more exposed than before.
