An AI system that Anthropic has never shipped worked out how to switch off the rule that stops one website from reading another, then proved it with a working exploit against Safari. The company’s Frontier Red Team published the chain on October 28 alongside four others.
The Safari case is unusual because no code ever runs. Starting from a prompt, the model found a use-after-free in JavaScriptCore, where stale pointers from certain TypedArray operations overwrote metadata on freed memory. It then located variables inside WebKit’s Gigacage – the buffer Apple builds to keep type-array data apart – that could be used to index into other regions, giving arbitrary read and write outside the cage.
A third weakness in the WebContent sandbox’s inter-process messaging let it lift stored history, cookies and session databases off disk. The final step rewrote a single value in memory to disable the same-origin policy.
What that buys an intruder is quiet. A malicious page could open a signed-in mailbox and read it, or pull bank balances, with no prompt and no visible change. The chain also needs no memory-corruption primitive to finish, which makes the completion harder to spot than a standard drive-by.
Apple acknowledged the report the same day and shipped a repair, credited to Milad Nasr and Nicholas Carlini with Claude. The fix landed in iOS and iPadOS 26.5.2 back in June, so installed devices are already covered.
Anthropic says the model found 62 Chrome flaws fixed by version 156, and 13 sandbox escapes among them. Every bug was disclosed privately before publication.
One caveat matters. The claim of minimal human input rests on Anthropic’s own account, and the company does not describe what its researchers did at each stage.
