Anthropic's secret AI extracted data from a locked Android phone and escaped Chrome's sandbox

Anthropic says an unreleased AI model found security weaknesses and combined them to create working attacks against Chrome, Safari, Android, Windows and Linux. The company tested these attacks in controlled settings and reported the weaknesses to the companies responsible for the affected products. Those companies have now released fixes for all the reported problems.

Anthropic's Frontier Red Team described five groups of connected attacks that the model created with little human help after receiving some initial instructions. Anthropic has not revealed the model's name, said when it might become available, or fully explained how much help researchers gave at each step.

In one test, the AI combined four Chrome security flaws to break out of the browser's protected area and run code outside it. In a demonstration, the Calculator app opened on a Mac just seconds after a harmful webpage loaded. No further action from the user was needed. In another test, an attack against Safari got around a security rule that stops websites from reading each other's data. This could expose information from websites where a user was signed in.

The other demonstrations targeted Android, Windows and Linux. An attack on Android could copy photos and other data from a locked phone, but someone needed physical access to the phone through a USB connection. An attack on Windows could repeatedly crash a server that accepts HTTP/3 requests, but it could not run code or access saved data.

The Linux attack went further. It could let an attacker take full administrator control of a server over a network, without logging in or needing the user to do anything. However, the attack only worked with a particular network setup and would not work on every Linux system.

Anthropic says these findings show that AI could help security researchers find and fix weaknesses before attackers use them. The demonstrations also show the dangers of AI models that can combine separate security flaws to create complete attacks. However, these tests took place in a lab and do not show that the attacks were used against real systems.

Andrew Sozinov - Technology writer - Has published 177 articles on Notebookcheck since 2024

I have been interested in computers, electronics and modern technology since I was a child. I started writing IT news in high school and have continued doing so for more than 10 years. During that time, I have worked for many media companies, and I am now a news editor at 3DNews. I also sometimes write reviews of smartphones. In July 2024, I decided to try writing news for Notebookcheck. When I am not working, I enjoy playing video games, solving puzzles and traveling.