Anthropic · Vulnerability research · Exploit chains
The AI found several locks on the same door. It demonstrated why the door needed all of them.
Anthropic’s October 27 report describes five investigations using an unreleased internal research model across Chrome, Safari, Android, Windows and Linux. The company reports working proof-of-concept attacks after initial prompting, with coordinated vendor disclosure and fixes. Its Chrome demonstration opened Calculator outside the browser sandbox on a default macOS setup. The important step is combining weaknesses across security boundaries, rather than merely spotting suspicious code. Google’s Chrome 156 notes separately credit Anthropic researchers assisted by Claude on several vulnerabilities.
The demonstrations have different prerequisites and outcomes. The Android case required physical possession of a locked phone and USB access. Windows involved denial of service on a system serving the relevant network protocol, rather than file theft or remote control. The Linux example required a multipath-TCP listener. Safari concerned defeating separation between websites and accessing information, rather than unrestricted code execution. These distinctions prevent five different investigations from becoming a claim that any ordinary device can be taken over in the same way.
Vendor acknowledgments support the existence of real defects without independently measuring every claim about model autonomy. The report describes work performed over months, and fixes have their own release dates. The internal model is unnamed, so comparisons with public products remain limited. For defenders, the useful outcome is a verified problem followed by remediation; for attackers, similar reasoning could be valuable too. The browser had several security doors. The researchers found a route through them, then gave the people responsible a chance to repair the locks before publishing the map.
Source: The demonstrations, conditions and coordinated disclosure ↗Source: Vendor acknowledgment of Claude-assisted findings ↗
Causal Security · Cipher · EPICS Base
The AI inspected the control-room software. The scientists have some maintenance to schedule.
Causal Security says Cipher found and validated four EPICS Base memory-safety flaws in three hours and 49 minutes. EPICS helps scientific facilities monitor and control equipment, including accelerators and telescopes. The developer describes autonomous investigation followed by one instruction authorizing deeper testing in a sandbox. The speed and division of labor remain attributed claims. The maintainer record provides a separate check: two patch pull requests acknowledge Shubham Raj’s confidential report, and EPICS Base 7.0.11 includes security hardening.
The critical issue, CVE-2026-114595, carries a CVSS 3.1 score of 9.8. Cipher reproduced memory corruption and a crash; remote code execution remained a possible consequence, not a demonstrated exploit. Causal reported the issues in June, and relevant fixes merged in July and August, before October’s public disclosure and release. A reachable vulnerable service is still a prerequisite. The report does not establish an intrusion into a working facility or damage to its equipment. Physical consequences depend on the deployment and its independent protection systems.
Maintainers advise thorough compatibility testing before rollout, particularly with older clients and custom integrations. That is a reminder that remediation is an operational job, not just a version number in an article. Facilities need to know which components they run and how an update affects their workflows. Discovering defects early can improve defense even when the defects are serious; it does not turn a laboratory crash into confirmed physical harm. The accelerator may operate near the limits of modern physics. Its control software still has to count bytes correctly.
Source: The reported workflow, observed effects and disclosure timeline ↗Source: The acknowledged Channel Access fix ↗Source: The separate deserialization fix ↗Source: The release and compatibility-testing guidance ↗
IBM · Agent identity · Enterprise controls
IBM gave the AI an employee badge. Somebody else can revoke it.
IBM’s October 27 TechXchange announcement connects agent identity with credential management and governance. Agent Identity records ownership and delegated authority, while HashiCorp Vault supplies controls such as short-lived credentials and revocation. The aim is to limit access outside the model’s own reasoning process. An agent should not inherit an employee’s entire authority simply because that employee gave it an assignment. Knowing which agent is acting is useful, but it does not settle whether the next action is permitted.
Availability matters. IBM lists Agent Identity, Vault 2.2 and watsonx Orchestrate’s evaluation capabilities as generally available. Orchestrate’s cross-platform discovery and containment features remain in technology preview, including proposed isolation and shutdown controls. Evaluation, visibility and permission enforcement perform different jobs. A system can record an action without stopping it, or know an agent’s owner without limiting its credentials. The promised collection therefore needs assessment as an operating system of controls, rather than a single badge that makes every action trustworthy.
The direction addresses a recurring ADTU concern: authority should be granted and withdrawn by systems that do not depend on the agent agreeing to stop. Its effectiveness still requires evidence. A valid short-lived credential can be misused during its lifetime; a shutdown control needs a detected problem and a working path to act on it. General availability is a product milestone, not proof that every attack or unauthorized action is prevented. The AI now has a badge, a manager and a permissions list. The next test is whether the badge reader works when it arrives after hours.
Source: Identity, credential controls and availability labels ↗Source: The management and evaluation capabilities ↗