Letsdatascience AI-Driven Exploit Bypasses Apple's M5 Security in Days
Article Content
- •Calif exploited Apple's M5 chip security in under a week using AI assistance.
- •The exploit is the first public demonstration of bypassing Apple's Memory Integrity Enforcement.
- •Human expertise was crucial in conjunction with AI for developing the exploit.
Researchers from Calif, a Palo Alto-based cybersecurity startup, successfully exploited Apple's Memory Integrity Enforcement (MIE) on the M5 chip within a week using Anthropic's AI model, Claude Mythos. The exploit involved linking two bugs and several techniques to achieve kernel memory corruption, allowing unauthorized access to restricted system areas. The exploit is notable as it is the first public demonstration of a macOS kernel memory corruption bypassing MIE protections. Calif's team discovered the initial vulnerabilities on April 25, 2026, and had a working exploit by May 1, 2026. They reported their findings directly to Apple, emphasizing the role of human expertise alongside AI in developing the exploit. The incident raises concerns about the accelerating capabilities of AI in offensive cybersecurity. Apple is currently investigating the reported vulnerabilities and is expected to release a patch soon.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (28)
Following this threat?
Track Apple in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…
Critical Zero-Day Exploit Found in BeyondTrust Remote Support BeyondTrust disclosed a critical vulnerability, CVE-2026-102764, in its Remote Support product, exploited by the suspected China-linked group ARMORY CASTLE since August 2026. This flaw, with a CVSS score of 9.3, allows attackers to perform arbitrary file uploads and gain host-level control without requiring…