Mythos (formerly known as Claude Mythos Preview), an unreleased AI model currently under development at Anthropic, has uncovered previously unknown vulnerabilities lurking within macOS, one of the world's most robust operating systems. A research team at Calif, a cybersecurity firm based in Palo Alto, applied Mythos's technology within a testing environment conducted in April 2026 and identified two unknown bugs.
By chaining these bugs together, an attacker could execute privilege escalation, gaining access to deep system areas that would normally be off-limits. According to reporting by the Wall Street Journal, if this exploit were combined with other attack techniques, there is a risk that full control over a targeted Mac could be seized.
Because Mythos possesses an extraordinarily high capability for discovering software vulnerabilities—with unimaginable risks if misused—Anthropic's engineers have deliberately withheld it from public release. Currently, the company grants access to Mythos exclusively for defensive security research purposes to roughly 40 designated organizations, including Apple, Google, and Microsoft, under an initiative called "Project Glasswing." Up to $100 million in usage credits have been provided for this effort, reflecting an industry-wide cooperative stance toward advancing AI-driven cyber defense.
Anthropic has implemented strict safeguards on the AI's outputs to mitigate the risk of the model autonomously discovering and weaponizing zero-day vulnerabilities. Within the Project Glasswing framework, participating companies search for vulnerabilities in each other's products, and any bugs discovered are reported to vendors confidentially through a responsible disclosure process. Yet even within this consortium with its limited access privileges, Mythos continues to identify critical bugs one after another—making it easy to imagine the destructive potential if nation-state hackers or sophisticated cybercriminal organizations were to develop an equivalent model independently.
Breaking Through the Wall of Apple's Latest Protection Technology, "Memory Integrity Enforcement"
What makes this discovery particularly noteworthy is that the target system was equipped with Apple's latest M5 processor and had "Memory Integrity Enforcement (MIE)" enabled. MIE is a hardware-based protection feature built on ARM's Memory Tagging Extension (MTE) technology, introduced with the aim of dramatically raising the difficulty of executing memory corruption exploits. Historically, bugs where a software pointer references an invalid memory region have frequently been exploited as an entry point for attackers to execute arbitrary code.
Memory corruption bugs are often the starting point for serious attacks against modern operating systems. Since attackers attempt to access protected memory regions or execute unauthorized code, Apple has spent years building defenses on both the hardware and software fronts of its Apple Silicon systems. MIE assigns a special "tag" at the time of memory allocation, and any access where the pointer's tag doesn't match the tag of the actual memory region is immediately blocked at the hardware level. This was designed to significantly reduce the reliability of classic yet devastating exploits such as buffer overflows and use-after-free vulnerabilities.
MTE, provided by the ARM architecture, assigns 4 bits of metadata to each chunk of memory, enabling fast hardware-level verification that pointers and memory regions match. Google, too, has been pushing forward with MTE adoption as a trump card for strengthening security on Android devices, meaning the entire mobile and desktop ecosystem is increasingly dependent on this technology. Calif's breakthrough here is not merely an Apple-specific problem—it serves as a warning to the entire industry about the dangers of over-relying on MTE.
Calif's research team completed a local privilege escalation chain achieving kernel-level privileges on bare-metal M5 hardware where MIE's strict tagging and protections were actively functioning. This represents the first publicly disclosed macOS kernel memory corruption exploit against Apple's new MIE hardware protection. This attack vector—which escalates from standard user privileges to a root shell by leveraging standard system calls and multiple exploitation techniques—has a level of sophistication that macOS has never faced before, in that it manages to outmaneuver even hardware-level protection mechanisms.
"Hybrid Hacking": A Fusion of AI and Human Expertise
What's important to understand when analyzing this event is the fact that Mythos did not complete this complex exploit chain on its own. As Calif CEO Thai Dong stated, "This would not have been possible with Mythos alone; it drew on the very human cybersecurity expertise of Calif's hackers"—this was not a fully autonomous attack.
Mythos demonstrated strength in identifying known bug classes and accelerating certain parts of the research process. However, connecting two independent vulnerabilities into precise exploit code capable of bypassing MIE's protections required advanced reasoning and trial-and-error from top-tier security researchers. The research team is said to have developed the exploit chain in roughly five days after discovering the bugs in late April.
The role of AI in cyberattacks is no longer confined to monotonous code generation or vulnerability scanning. This case proves that AI has begun operating in practice as an "advanced analytical assistant" supporting human experts. At the same time, unlike remotely self-propagating worm-like threats, this means that, at the current stage, considerable technical resources are still required on the attacking side as well. The hybrid attack method—in which AI uncovers a complex lead and human hackers logically piece it together—is likely to become the mainstream form of cyber threat going forward.
Future Challenges Posed by AI-Driven Vulnerability Discovery
Calif's research team compiled their findings into a 55-page technical report and delivered it directly to Apple's headquarters in Cupertino for a detailed briefing. An Apple spokesperson commented, "Security is our top priority, and we take reports of potential vulnerabilities extremely seriously," and verification of the report's contents along with patch development are reportedly underway.
Detailed technical information will not be disclosed until Apple provides a fix. While Dong expects the issue to be "fixed relatively soon," this case raises important questions for the technology industry as a whole.
The ability of AI models to discover unknown vulnerabilities is a double-edged sword: a powerful weapon for defenders, but a catastrophic threat if it falls into the hands of attackers. Prior to the macOS case, Mythos also identified a bug that had lain dormant in OpenBSD for 27 years, as well as a machine takeover vulnerability in Linux.
Defensive use within a closed environment like Project Glasswing is arguably one of the best solutions available at present. However, as open-source AI models continue to evolve, the possibility cannot be ruled out that models with comparable vulnerability-discovery capabilities will become widely available in the future. Now that even static or hardware-based defensive walls like MIE have been breached, the security industry is being forced to shift away from patch-based defenses and toward more autonomous, adaptive defense approaches—such as AI-powered real-time memory monitoring and intelligent sandboxing technologies that dynamically block anomalous system call behavior. The transition to a new design philosophy that transcends the boundary between hardware and software is no longer something that can wait.