A small Palo Alto security firm used Anthropic's unreleased Claude Mythos Preview to build the first public macOS kernel exploit that defeats Apple's M5 security shield.
Calif Breaks Apple's MIE Shield
The exploit, unveiled Thursday by Calif in a Substack post, chains two macOS bugs with several techniques to achieve full privilege escalation on Apple's M5 silicon. The Wall Street Journal first reported the findings.
Calif researchers delivered the 55-page technical report to Apple's Cupertino headquarters in person this week, the company said.
The team bypassed Memory Integrity Enforcement, the hardware-backed defense Apple spent five years engineering to block memory corruption attacks. Building the exploit code took just five days.
Also Read: Southeast Asia Blockchain Week Brings Ripple, Avalanche, Solana Foundation, And K-Pop To Bangkok
Why The Mythos Exploit Matters
Mythos identified the bugs because they belonged to known categories, Calif wrote. But Apple's MIE protection is new, so human expertise carried the final stretch. The pairing produced a result that traditional auditing rarely matches at this speed.
Thai Duong, Calif's chief executive, told the WSJ that Mythos excels at reproducing documented attack patterns and auditing code. He said the model has not yet invented entirely new attack techniques on its own.
Former Google security researcher Michał Zalewski reviewed the work and called the technique significant because macOS is one of the toughest targets for hackers, though he warned that some Mythos hype may be overblown.
The exploit functions as a privilege escalation attack. Chained with another initial vector, it could let a malicious actor seize full control of a Mac.
Mythos Stays Locked Behind Project Glasswing
Anthropic released the Mythos Preview in April after internal and external evaluations suggested the model could autonomously find and exploit software flaws beyond previous public systems. The company restricted access to select technology firms, banks, and researchers under its Project Glasswing initiative rather than a wide rollout.
Mozilla has said Mythos surfaced 271 vulnerabilities in Firefox during internal testing. The U.K.'s AI Security Institute found the model could complete multi-stage cyberattack simulations without human direction. Apple recently joined Project Glasswing to scan its own codebases defensively.
Calif plans to withhold the full attack chain until Apple ships fixes for the underlying bugs.
Read Next: Gemini Space Station Hit By Multiple Securities Fraud Claims After IPO
