Company

calif.io • May 15, 2026

We're a security firm from California on a mission to make the Internet safer for everybody. Right now, that means pushing the frontier of vulnerability research with AI, figuring out what's possible before the wrong people do.

Thai was born in Saigon and grew up on the Internet. He has spent most of his life asking computers impolite questions. For 12 years, he led security and cryptography work at Google, breaking and defending Gmail, Android, and YouTube, and co-creating Google Tink and Project Wycheproof. Earlier, he helped discover the SSL vulnerabilities affectionately known as BEAST, CRIME, and POODLE, a trilogy no one asked for but everyone patched.

✓ 12 years Google Security

🏆 Pwnie Award winner for Best Cryptographic Attack

An is a research-driven penetration tester with a suspicious number of maximum bounties from PayPal, Netflix, and Walmart. He maintains a 100% success rate in red teaming engagements, a statistic both reassuring and slightly alarming. An has spoken at Black Hat Europe, ZeroNights St. Petersburg, and BSides Singapore, usually things that shouldn't have worked but did.

✓ 100% red team success rate

Michał wrote afl-fuzz, the tool that finds bugs faster than most people can deny them. A security researcher, author, and longtime breaker of things, he's contributed more to the art of crashing software than most malware ever did. Previously at Google and Snap, he now divides his time between writing, research, and inventing new ways to prepare for the inevitable apocalypse, irresponsibly disclosed, of course.

🏆 Pwnie Award for Lifetime Achievement

Parisa runs Chrome at Google and leads Project Zero, a small band of wannabe hackers who spend their days discovering vulnerabilities and their nights trying to name them dramatically. Officially, she's Google's "Security Princess." Unofficially, she's the reason your browser updates while you sleep. Beyond Google, she's lectured at Harvard, advised the White House, and occasionally translates hacker-speak for Hollywood screenwriters.

✓ Google Security Princess

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AI-Driven Exploit Bypasses Apple's M5 Security in Days Researchers from Calif, a Palo Alto-based cybersecurity startup, successfully exploited Apple's Memory Integrity Enforcement (MIE) on the M5 chip within a week using Anthropic's AI model, Claude Mythos. The exploit involved linking two bugs and several techniques to achieve kernel memory corruption, allowing unauthorized access to restricted system areas. The exploit is notable as it is the first public demonstration of a macOS kernel memory corruption bypassing MIE protections. Calif's team discovered the initial vulnerabilities on April 25, 2026, and had a working exploit by May 1, 2026. They reported their findings directly to Apple, emphasizing the role of human expertise alongside AI in developing the exploit. The incident raises concerns about the accelerating capabilities of AI in offensive cybersecurity. Apple is currently investigating the reported vulnerabilities and is expected to release a patch soon. 21 sources 70

Extracted Entities

Company

The full story

Extracted Entities

Ransomware Groups (1)

Tools (1)

Vulnerabilities (2)