AI and the World's Hard Problems · Theoretical computer science · Anthropic · 2026-10-13
Reverse engineering Claude's CVE-2026-2796 exploit
Anthropic describes how Claude Opus 4.6 wrote a proof-of-concept exploit for CVE-2026-2796, a patched Firefox vulnerability, after being given a virtual machine, a task verifier and about 350 chances to succeed. The exploit only works in a test environment that deliberately removes some browser security features, and Claude is not yet writing full-chain exploits that escape the browser sandbox. Opus 4.6 turned a vulnerability into an exploit in only two cases out of hundreds of chances across dozens of bugs, which the researchers see as an early warning of where capabilities are heading.