Researchers used AI to help identify and exploit macOS vulnerabilities, completing a working attack in five days.
Calif, a Silicon Valley cybersecurity firm, identified a method to exploit Apple’s macOS by using two software flaws together (“chaining”), first gaining limited access and then escalating that access to full control of the system. The team used Anthropic’s Mythos to scan code for weaknesses and suggest ways to trigger them, then tested and refined those suggestions manually. This method grants access to restricted parts of the device, potentially enabling full system control when combined with other attacks.
Calif said they developed custom code that links two vulnerabilities into a privilege-escalation exploit. A privilege escalation exploit allows a user with limited access to gain higher-level permissions. In this case, the method targets the operating system kernel, which manages core system functions and enforces security boundaries.
Using Anthropic’s Mythos to analyze macOS code, the Calif team identified weaknesses and reproduced known attack techniques. Human researchers directed the process and confirmed the results. Calif’s chief executive told The Wall Street Journal the exploit “couldn’t have been pulled off by Mythos alone,” and required human expertise to complete the attack chain.
They built a working exploit in about five days. The effort involved a small number of engineers who identified the bugs, developed the exploit chain, and validated the results.
Apple is known as a tough nut to hack. The company invests heavily in system-level protections, integrating safeguards through its hardware and software components. Apple told The Wall Street Journal it is reviewing the findings and stated, “Security is our top priority, and we take reports of potential vulnerabilities very seriously.”
Anthropic has limited access to Mythos because of its ability to discover previously undetectable vulnerabilities in large numbers. The company gave limited access to a handful of large tech companies and cybersecurity firms to help find and fix security flaws before they are exploited.
Calif hasn’t yet released the full technical details or exploit code. They said they provided a 55-page report to Apple and plan to disclose more information after a fix is in place.
