AI Models Show Ability to Create Browser Exploits, Study Finds
Researchers at Carnegie Mellon University have developed a benchmark demonstrating that advanced AI models can autonomously create browser exploits in Google’s V8 JavaScript engine, according to a report from The Decoder. The study found Anthropic’s Claude Mythos significantly outperformed OpenAI’s GPT-5.5 in exploit development capabilities, though at twelve times the computational cost.
The benchmark tested AI agents’ ability to identify and exploit real vulnerabilities in the V8 engine, which powers Google Chrome and other major browsers. While both models achieved proof-of-concept exploits, Mythos demonstrated superior performance in both complexity and reliability of attacks, the report stated. Researchers noted the findings highlight growing concerns about AI-driven cybersecurity threats.
“This research underscores the dual-use nature of advanced AI systems,” said the study’s lead author in an interview. “While these models enable breakthroughs in software development, they also present unprecedented risks if misused.”
Google’s V8 engine, developed by the company’s Chromium project team, processes JavaScript for over two billion devices worldwide. The university’s Pittsburgh-based cybersecurity lab conducted the research with support from the National Science Foundation.
Researchers emphasized the need for improved AI safety measures as commercial models approach human-level coding capabilities.
