The first public macOS kernel memory-corruption exploit running on Apple M5 silicon was built in just five days using a combination of human expertise and Anthropic’s AI model, Mythos Preview.
On May 14, 2026, the Calif research team personally visited Apple Park in Cupertino to hand-deliver their findings, deliberately bypassing the crowded vulnerability submission queue.
Their disclosure targeted macOS 26.4.1 (build 25E253) on bare-metal M5 hardware, and successfully bypassed Apple’s brand-new Memory Integrity Enforcement (MIE) mitigation.
Apple M5 macOS Kernel Exploit
The exploit chain is a data-only kernel local privilege escalation (LPE): starting from an unprivileged local user account, using only standard system calls, and ending with a full root shell with no code injection or JIT tricks, making it exceptionally stealthy against traditional anti-malware detection.
MIE is Apple’s hardware-assisted memory safety system built around ARM’s Memory Tagging Extension (MTE), introduced as the flagship security feature for both the M5 chip and the A19, said Calif team.
Each 16-byte memory slice is labeled with a 4-bit tag tied to the pointer that owns it, ensuring no read or write operation targets unintended memory regions even at the kernel level.
Apple’s implementation goes significantly further than standard MTE, adding Tag Confidentiality Enforcement to block side-channel leaks like the TikTag attack, and non-tagged memory protection to close bypass routes targeting global variables.
According to Apple’s own research, MIE disrupts every known public iOS exploit chain, including the recently uncovered Coruna kit, a 23-exploit suite targeting iOS 13 through 17.2.1 and its successor DarkSword, which targets iOS 18.4 through 18.7.
Mythos Preview, Anthropic’s unreleased frontier AI model announced on April 7, 2026, was instrumental throughout the research.
Announced alongside findings from the UK AI Security Institute, which confirmed the model could autonomously execute multi-stage attacks on vulnerable network tasks that would otherwise take human professionals days of work.
Mythos had already demonstrated the ability to identify thousands of previously unknown vulnerabilities.
In the Calif engagement, Mythos identified the bugs rapidly because they fell within known vulnerability classes; human expertise then guided the MIE bypass, as the novel mitigation required nuanced judgment that the AI alone couldn’t fully resolve.
Dang found the initial bugs on April 25. Blazakis joined on April 27. Maine completed the tooling, and a working exploit chain was confirmed by May 1, just 6 days from discovery to a root shell.
The attack chains two kernel vulnerabilities, manipulating kernel credential structures to escalate privileges while evading MIE’s tag-checking via timing and allocation pattern abuse.
Calif has not released its full 55-page technical report, withholding details until Apple ships a patch.
The disclosure serves as a stark signal: Apple’s best hardware mitigations, built over five years, can now be outpaced by a small AI-assisted team operating on a one-week timeline.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
