Anthropic Mythos Preview Helped Build the First Public macOS M5 Kernel Exploit in Five Days

Researchers at Palo Alto-based Calif used Claude Mythos Preview to build the first publicly disclosed macOS kernel memory corruption exploit on Apple's M5 chip, surviving the company's new Memory Integrity Enforcement protection. The timeline is almost absurd: the full exploit chain came together in roughly five days of work, after Apple had spent five years and an estimated multi-billion-dollar budget engineering the defense it bypassed.

Calif is three people: Bruce Dang, Dion Blazakis, and Josh Maine. Dang found the first bug on April 25. Blazakis joined two days later. Maine built the exploitation tooling, and they had a working chain by May 1. That's not a typo.

As someone who covers AI tooling daily, what stands out here isn't the speed alone. It's what the speed implies about how exploit economics are shifting when a capable model pairs with experts who already know where to look.

What Apple's MIE Actually Does

To understand why this matters, you need to understand what Memory Integrity Enforcement (MIE) is and what it was designed to stop.

MIE is a hardware-assisted memory safety system built on ARM's Memory Tagging Extension (MTE). It was introduced as the flagship defense on the M5 and A19, aimed squarely at memory corruption, the bug class behind some of the nastiest iOS and macOS compromises ever pulled off.

MTE works by assigning a 4-bit tag to pointers and to 16-byte memory granules. When a pointer is dereferenced, the hardware checks if the pointer's tag matches the memory granule's tag. A mismatch triggers an exception, ideally halting the exploit dead in its tracks.

Apple went further than the base ARM spec. The system includes Apple's "Enhanced MTE" (EMTE) and other protections like Tag Confidentiality Enforcement and Secure Page Table Monitor (SPTM). EMTE enforces synchronous checking, meaning any tag mismatch immediately raises an exception, which is far more robust than MTE's asynchronous mode.

By Apple's own research, MIE breaks every publicly known exploit chain against modern iOS, including the leaked Coruna and Darksword toolkits. Until now, that record held.

How the Exploit Chain Works

The exploit is a data-only kernel local privilege escalation chain targeting macOS 26.4.1 (25E253). It starts from an unprivileged local user, uses only normal system calls, and ends with a root shell.

The "data-only" classification is the key technical detail. Standard memory corruption exploits often focus on corrupting pointers, such as buffer overflows or use-after-free vulnerabilities where an attacker overwrites a memory address to redirect execution flow. MIE, via its use of ARM's MTE, is designed to catch these precisely.

Calif's chain works around the check by never touching the operations MIE actually watches. By corrupting kernel data structures rather than pointers, the exploit sidesteps the tag-checking machinery entirely. The data-only nature of the exploit implies that these defenses, while strong against traditional memory corruption, are not foolproof against sophisticated data manipulation.

The chain links two distinct vulnerabilities. The exploit chain links two distinct vulnerabilities plus additional techniques targeting bare-metal M5 hardware with kernel MIE enabled.

What Mythos Preview Actually Did

This is where the story gets technically interesting. Mythos didn't autonomously write a kernel exploit. The division of labor was more precise than that.

Mythos Preview helped identify the bugs and assisted throughout exploit development. Mythos Preview is powerful: once it has learned how to attack a class of problems, it generalizes to nearly any problem in that class. Mythos discovered the bugs quickly because they belong to known bug classes. But MIE is a new best-in-class mitigation, so autonomously bypassing it can be tricky. This is where human expertise comes in.

Memory-corruption patterns such as use-after-free, double-free, and integer overflow leading to an undersized allocation are documented in security papers going back to the 1990s. Mythos has internalized those patterns and can scan for them at machine speed. The novel part, bypassing a brand-new hardware mitigation with a data-only approach, still required expert human judgment.

Anthropic released a preview of Claude Mythos in April and restricted access to selected companies, banks, and researchers under a program called Project Glasswing. Calif's report notes that internal and controlled evaluations of Mythos have found it capable of identifying large numbers of software flaws and completing complex simulated attack tasks; internal testing by some users identified hundreds of browser vulnerabilities that were later patched.

Key Technical Highlights

• The exploit targets macOS 26.4.1 and operates from an unprivileged local user, leveraging only standard system calls.
• The implementation path involves two vulnerabilities and several techniques, targeting bare-metal M5 hardware with kernel MIE enabled.
• The team has a 55-page technical report on the hack, but won't release it until Apple ships a fix for the exploit.
• Calif disclosed the bug to Apple in person at Cupertino; macOS Tahoe 26.5 already credits Calif and Anthropic Research for related fixes.
• Mozilla credited Mythos with surfacing 271 vulnerabilities in the latest Firefox release, all patched before publication.

What This Means for the Industry

Hardware-backed mitigations such as MIE and MTE raise the technical bar but do not eliminate memory-corruption attack surfaces; attackers can chain multiple weaknesses and use advanced tooling to find paths that bypass protections. The pairing of high-capability models and expert operators can shorten prototype timelines from months to days, changing attacker economics for proof-of-concept development and exploit refinement.

The next generation of memory-safety silicon has to plan for data-only attacks, not just pointer corruption. Apple's response will shape what shows up in Qualcomm, Mediatek, and Nvidia silicon over the next five years.

Anthropic launched Project Glasswing in April to channel Mythos's discovery capabilities toward defensive patching, with partners including Apple, Google, Microsoft, AWS, Cisco, and NVIDIA. That same week, Google's Threat Intelligence Group disclosed that it had, for the first time, identified a threat actor using a zero-day exploit it believes was developed with AI assistance. The same capability that Anthropic is deploying defensively under Glasswing is now appearing in offensive research and, according to Google, in active adversarial operations.

A defender with Mythos can find their own bugs faster than an unaided attacker can find theirs. An attacker with an equivalent model can find them at the same speed. Whoever has the better model and the cleaner integration wins more rounds.

The Calif team put it plainly in their blog post: "This work is a glimpse of what is coming. Apple built MIE in a world before Mythos Preview. We're about to learn how the best mitigation technology on Earth holds up during the first AI bugmageddon."

Final Thoughts

The technical choice I keep coming back to is the data-only approach. MIE is genuinely well-engineered: synchronous tag checking at the silicon level is a serious barrier to traditional pointer corruption. Calif didn't break it. They walked around it by operating entirely in the domain MIE wasn't watching. That's not a failure of Apple's design philosophy so much as a reminder that hardware mitigations define a perimeter, and perimeters always have edges.

What Mythos contributed is equally worth examining. This kind of kernel exploit against Apple silicon devices is widely considered one of the most technically difficult areas in cybersecurity, often requiring weeks or months of work by highly specialized researchers. Compressing that to five days by pairing a capable model with three people who already understood the domain is a concrete data point, not a theoretical one. The 55-page report will be the real test: once it's public and independently verifiable, we'll know exactly how much of the heavy lifting Mythos actually did versus what required Dang, Blazakis, and Maine's expertise.

For now, Apple has not yet issued a patch, and no public exploit exists. When a security update addressing this vulnerability ships, install it. The researchers are following coordinated disclosure norms, and nothing in the available reporting indicates this exploit has been used outside a controlled research environment. What do you think about AI-assisted exploit research? Does the defensive potential outweigh the offensive risk? Drop your thoughts in the comments.

---