Claude Mythos Cracked Apple M5 Security in 5 Days (2026)

Quick read: Anthropic’s Claude Mythos Preview helped a Vietnam-based security firm called Calif build a working exploit against Apple’s newest M5 Mac security in five days. The bypass targeted Memory Integrity Enforcement (MIE) — the hardware-assisted memory safety system Apple spent roughly five years and an estimated billions of dollars building, and which had previously disrupted every public exploit chain against modern iOS. The exploit was disclosed May 14, 2026; Apple is reviewing.
The point: AI just compressed a months-long vulnerability research project into a five-day sprint, against the strongest mass-market memory defense ever shipped. Humans still did the novel work, but AI changed the math.
Who needs this: Mac users, security professionals, and anyone tracking what frontier AI models can actually do.
Skip if: You want a step-by-step exploit walkthrough. The full technical write-up is being withheld until Apple ships a patch. Daily AI fundamentals in our free Beginners in AI newsletter.

Five days.

Three researchers, working under the name Calif out of Vietnam, used a preview version of Anthropic’s Claude Mythos to build a working exploit against the most expensive piece of memory-safety hardware Apple has ever shipped. Bug discovery on April 25. Working kernel chain on May 1. A trip to Cupertino to brief Apple security engineers in person. Public disclosure on May 14.

Apple spent something close to five years on Memory Integrity Enforcement. The Wall Street Journal puts the bill at “probably billions of dollars.” Until this week, MIE had reportedly broken every public exploit chain ever pointed at modern iOS.

The Calif post went up yesterday. I read the timeline twice.

What actually happened

Calif is three people: Bruce Dang, Dion Blazakis, Josh Maine. Dang found the first bug on April 25. Blazakis joined two days later. Maine built the exploitation tooling. They had a working chain by May 1.

What the chain does is technical, but the shape of it is the part to understand. They corrupted data, not pointers. MIE is a tag-check on memory pointers — every access carries an expected tag, the silicon refuses anything that mismatches. Apple built it to kill the entire class of pointer-corruption exploits that has dominated kernel attacks for thirty years. Calif’s chain works around the check by never touching the operations MIE actually watches.

Specifics for the searchable record: macOS 26.4.1, build 25E253, Apple M5 silicon, data-only kernel local privilege escalation.

The team flew to Apple Park to brief Apple in person. The 55-page write-up is being held until Apple patches.

Calif’s own line about the result: “Landing a kernel memory corruption exploit against the best protections in a week is noteworthy.” Read that one again.

What Memory Integrity Enforcement is and why this matters

Memory Integrity Enforcement is Apple’s hardware answer to memory-corruption bugs. Buffer overflows, use-after-frees, type confusion, all of it. The design is built on Arm’s Memory Tagging Extension specification from 2019, with Apple-specific hardening on top. Every memory chunk gets a tag. Every pointer carries the expected tag. The M5 silicon physically refuses any access where the tags do not match.

It’s enforced in silicon, not software. Software-only memory safety has been losing ground against state-level attackers for a decade — that is the reason Apple was willing to pour billions into a hardware fix in the first place. MIE was supposed to change the economics. Until this week, it largely had. Every public exploit chain pointed at modern iOS had broken on it.

The Calif exploit doesn’t break MIE. It walks around it. Data, not pointers. Privilege escalation without ever fighting the tag check directly. Most security people I’ve read assumed this kind of bypass against MIE was months of work, minimum.

It took five days.

How Mythos found the bugs

Calif was explicit about what Mythos did. They wrote: “Mythos discovered the bugs quickly because they belong to known bug classes.”

That sentence does most of the work. Memory-corruption patterns — use-after-free, double-free, integer overflow leading to an undersized allocation — are documented in security papers going back to the 1990s. A frontier model trained on enough of that literature learns the shape of these patterns in unfamiliar code. You drop the macOS kernel in front of it, point at a class of bug, and minutes later you get a triaged list. Work that used to take weeks of grepping and reading.

What Mythos did not do is invent the bypass. Chaining two bugs into a data-only path that sidesteps MIE — that’s the part that requires fifteen years of fighting kernel internals to know how to do. The AI accelerates discovery. Humans design the exploit.

Mythos compressed the part that scales with brute force. Humans did the part that requires invention. Both, this time.

What Project Glasswing actually is

Project Glasswing is Anthropic’s program for getting Mythos to defenders ahead of attackers. The launch partners list reads a little like an antitrust filing: AWS, Apple, Google, Microsoft, Nvidia. The idea is that whoever runs the largest pieces of consumer infrastructure should have the model first, scan their own code with it, and ship patches before the same capability becomes generally available.

It’s a reasonable theory. It also assumes attackers — including state-level ones — don’t already have something comparable. That’s optimistic. The open question, and nobody has a good answer to it, is how big the gap actually is between Mythos and whatever the better-funded offensive teams are training on data nobody’s heard of.

Per IEEE Spectrum, Mythos has flagged thousands of high- and critical-severity bugs across operating systems, browsers, and cryptography libraries. One of them was a 27-year-old OpenBSD flaw that crashes a remote machine when poked. Twenty-seven years. People shipped that code, reviewed that code, and ran it for nearly three decades before a model found the bug in an afternoon.

Apple’s official line on the M5 chain: “We are reviewing Calif’s report to validate the findings.” Standard pre-patch boilerplate. A fix is in progress, presumably.

What this means for the future of security research

The economics shifted this week. That’s the line you’ll hear repeated. It’s mostly right.

Finding bug-class candidates inside a million-line codebase used to be the bottleneck. With Mythos, it isn’t anymore. The work moves up the stack — designing bypasses, chaining bugs, making the chain survive contact with the real world. Defenders win if they have the model first and a patch pipeline that can act on what it returns. Attackers win if the bug exists and nobody else has found it yet.

Hardware defenses haven’t been defeated. MIE was not broken. It was routed around. The distinction matters — the next generation of memory-safety silicon has to plan for data-only attacks, not just pointer corruption. Apple’s response will shape what shows up in Qualcomm, Mediatek, and Nvidia silicon over the next five years. Whether Apple has time to redesign before this approach generalizes is unclear.

Then there’s the AI-vs-AI dynamic, which is the part that should make you nervous. A defender with Mythos can find their own bugs faster than an unaided attacker can find theirs. An attacker with an equivalent model can find them at the same speed. Whoever has the better model and the cleaner integration wins more rounds. Glasswing is Anthropic’s bet that defenders should be ahead by policy, for as long as Anthropic can hold that line.

The bet might not hold for long.

What this means for Mac users today

Practical advice, not alarmist:

• You are not in immediate danger. The exploit needs local code execution. An attacker would already have to be on your machine for it to matter. It’s not a drive-by.
• The full write-up isn’t out. Calif’s 55 pages are sitting in Apple’s mailbox until the patch ships. There’s no public weaponized version yet.
• Install the next macOS security update the day it lands. That is the only thing a regular user can do that actually moves the needle.
• Don’t read this as “M5 is broken.” Calif chose M5 because MIE was the hardest target on the market. The story is the speed, not the silicon.
• This isn’t only Apple’s problem. Every modern kernel has the same shape of attack surface. Linux, Windows, Android — different details, same class.

Where Mythos sits in the Anthropic lineup

Mythos sits above Claude Opus in Anthropic’s model lineup. Above Sonnet. Above Haiku. It’s preview-only right now, gated through Glasswing partners and a small set of approved research labs. The general API and consumer apps still default to Opus and Sonnet.

There is no public waitlist yet. If Anthropic ships Mythos widely, the Anthropic blog will get there before any tech news site does. For background on the model itself, see our Claude Mythos guide. For the rest of the lineup, see Claude Opus vs Sonnet vs Haiku. For Claude Code, the developer surface that ships alongside Mythos when it goes generally available, see what is Claude Code.

FAQ

What is Claude Mythos?

Anthropic’s frontier model tier, above Opus. Currently in preview, gated through Project Glasswing partners. It’s the model that Calif used to identify the macOS kernel bugs chained in the M5 exploit disclosed May 14, 2026.

Did Claude Mythos hack a Mac?

Not on its own. Mythos identified two memory-corruption bug candidates in the macOS kernel. Three human researchers at Calif then designed the bypass technique that chains the bugs into a working privilege-escalation exploit. The AI accelerated discovery. The humans built the exploit.

What is Memory Integrity Enforcement (MIE)?

Apple’s hardware-assisted memory safety system, built on Arm’s Memory Tagging Extension specification. It physically prevents memory accesses whose pointer tag does not match the allocated memory’s tag, blocking most traditional memory-corruption exploits. The Calif chain works around MIE rather than defeating it directly.

Is my Mac vulnerable right now?

The exploit needs an attacker to already be running unprivileged code on your Mac. It’s not a remote drive-by. Full details haven’t been released, so there’s no public weaponized version. Apply the next macOS security update when Apple ships it.

What is Project Glasswing?

Anthropic’s coordinated disclosure initiative giving major infrastructure companies (Apple, AWS, Google, Microsoft, Nvidia) early access to Claude Mythos for defensive vulnerability research. The goal is to let defenders find and patch zero-days before attackers get equivalent AI capability.

Can I use Claude Mythos myself?

Not yet, not publicly. Mythos is in preview, gated through Glasswing partners and a small set of approved research labs. Anthropic hasn’t announced general availability. Claude Opus and Claude Sonnet remain the consumer-accessible top tiers for now.

The bottom line

This is not a story about AI breaking into a Mac. It’s a story about AI compressing the boring half of vulnerability research from months into days, and handing the interesting half to humans who already knew what to do with it.

That’s the more important story. Same dynamic applies to every system with a kernel, a browser, a network stack, or a cryptography library. The bug-class search problem has been the security industry’s bottleneck for thirty years. It isn’t anymore.

Apple will patch these bugs. The next macOS will close the specific hole. The change in research speed doesn’t get patched.

For daily reads on what frontier AI is actually doing — not the headlines, the substance — subscribe to the free Beginners in AI newsletter.

Sources

• Calif’s own write-up (blog.calif.io) and 9to5Mac coverage, May 14, 2026 — detailed timeline (April 25 bug discovery, May 1 exploit completion) and researcher attribution (Bruce Dang, Dion Blazakis, Josh Maine).
• Wall Street Journal, May 14, 2026 — Calif’s simultaneous primary disclosure outlet.
• IEEE Spectrum, “Claude Mythos Preview Exposes Hidden Code Flaws Fast” — Project Glasswing partner list (AWS, Apple, Google, Microsoft, Nvidia) and broader vulnerability discovery context (thousands of high/critical-severity flaws).
• MacRumors, AppleInsider, Decrypt coverage of the disclosure — confirmation of the macOS 26.4.1 build 25E253 target and Apple’s “reviewing the findings” response.
• Daring Fireball, May 14, 2026 — John Gruber’s read of the disclosure and Apple Park briefing.
• The Hacker News, “Anthropic’s Claude Mythos Finds Thousands of Zero-Day Flaws Across Major Systems” (April 2026) — Project Glasswing launch reporting.
• Arm Memory Tagging Extension (MTE) 2019 specification — the architectural foundation underneath Memory Integrity Enforcement.

Related news

• Glossary: What is Project Glasswing?
• Glossary: What is Memory Integrity Enforcement (MIE)?
• Glossary: What is a Trusted Execution Environment (TEE)?
• Microsoft is canceling Claude Code licenses for thousands of engineers — news, May 14–15 2026.
• May 2026 AI updates: one-page cheat sheet — the full month at a glance.