Security researchers at Calif, a Palo Alto-based cybersecurity startup, said they used Anthropic’s Claude Mythos Preview model to help build a working exploit against Apple’s new M5-era memory protections in five days, a claim that puts two of Silicon Valley’s most closely watched technology races — AI capability and hardware security — on a direct collision course.

In a post published May 14, Calif said its engineers developed what it described as the first public macOS kernel memory-corruption exploit on Apple M5 silicon that can survive Memory Integrity Enforcement, or MIE, Apple’s hardware-assisted memory-safety system. The company said it delivered the findings to Apple in person at Apple Park in Cupertino and plans to release a 55-page technical report after Apple fixes the vulnerabilities and attack path.

The researchers said the exploit chain targets macOS 26.4.1 on bare-metal M5 hardware with kernel MIE enabled. According to Calif, it begins from an unprivileged local user, uses normal system calls and ends with a root shell. The startup said the implementation involved two vulnerabilities and several techniques, but it withheld the full technical details to avoid enabling copycat exploitation before patches are available.

Calif said the timeline was unusually compressed. In its account, researcher Bruce Dang found the bugs on April 25, Dion Blazakis joined Calif on April 27, Josh Maine built tooling, and the team had a working exploit by May 1. The company said Mythos Preview “helped identify the bugs and assisted throughout exploit development,” while adding that human expertise remained necessary because bypassing a new mitigation such as MIE is not a purely push-button process.

The claim is notable because Memory Integrity Enforcement is one of Apple’s most ambitious security projects. Apple introduced MIE in 2025 as a deeply integrated hardware-and-software defense built around Enhanced Memory Tagging Extension, secure allocators and tag-confidentiality protections. Apple said at the time that the system was the culmination of roughly half a decade of engineering work and represented a major upgrade to memory safety in consumer operating systems.

Memory-corruption flaws have long been a favored route for sophisticated attackers because they can allow software to read, write or execute code in ways the operating system should block. Apple’s strategy with MIE is to make such attacks much more expensive and unreliable by tagging memory allocations and forcing hardware-level checks when software tries to access them. If a request does not carry the expected tag, the system can block the access and let the operating system respond.

That does not make MIE a guarantee against every possible attack. Apple’s own security write-up acknowledged that no defense is perfect and framed the system as a way to dramatically constrain attackers’ options, particularly the mercenary spyware operators that spend heavily on sophisticated exploit chains. Calif’s post made a similar point from the offensive side: the company said MIE was “never meant to be hacker-proof” and that the right vulnerabilities can still create a path around it.

The new element is the role Calif assigns to Anthropic’s Mythos Preview. Anthropic announced Project Glasswing in April as an initiative to give selected partners access to Claude Mythos Preview for defensive cybersecurity work. The company described Mythos as a frontier model with unusually strong computer-security capabilities and said Project Glasswing partners would use it to identify and fix vulnerabilities in critical software, endpoints, binaries and other foundational systems.

Anthropic has not made Mythos Preview generally available. Its public Project Glasswing materials say participants receive early access for defensive cybersecurity purposes, and the launch roster included major technology and infrastructure firms. That restricted-access approach reflects a central concern now facing frontier AI labs: the same models that can help defenders find and patch bugs faster may also lower the cost and time required for attackers to locate viable exploit paths.

The Calif episode is not a confirmed mass-market security incident, and there is no public evidence from the researchers’ post that ordinary Mac users are being targeted through the exploit. The described attack is a local privilege-escalation chain, meaning an attacker would still need a path to run code locally before using it to obtain deeper system privileges. That distinction matters because it separates the reported vulnerability research from a remote, internet-scale compromise.

Still, for Apple, the claim lands in a sensitive area. The company has increasingly emphasized hardware-backed security as a differentiator for its devices, especially as Macs and iPhones become higher-value targets for spyware vendors, cybercriminal groups and state-linked operators. A working MIE bypass on M5 hardware, even under controlled research conditions, would give Apple’s security teams a concrete test case for strengthening the defense before similar techniques are independently found elsewhere.

For Anthropic and the broader AI industry, the episode is another data point in the shift from AI as a coding assistant to AI as an active security-research accelerator. Earlier reporting and partner accounts around Mythos have already focused on its ability to identify vulnerabilities across large codebases. Calif’s claim goes further by tying the model to exploit development against a modern hardware-assisted mitigation, while making clear that expert researchers still had to guide, validate and complete the work.

The most immediate question is how Apple responds. Calif said it shared the vulnerability research with Apple and will hold back the full technical report until fixes are released. That is consistent with coordinated vulnerability disclosure norms, though the company’s public post also increases pressure by drawing attention to the exploit before patch details are known. Apple had not published a public advisory for the specific reported chain as of the cited reports.

The broader security takeaway is not that AI has made advanced device defenses obsolete. It is that the economics of vulnerability discovery may be changing quickly. When skilled researchers can pair domain expertise with a model tuned for security reasoning, testing cycles that once took large teams and long timelines may become shorter. That could help defenders harden software faster, but it could also force platform vendors to assume that new mitigations will be probed by AI-assisted teams almost immediately after release.

For Silicon Valley, the case is likely to intensify scrutiny of how frontier AI labs distribute cyber-capable systems, how platform companies structure private disclosure channels and how regulators think about dual-use AI tools. Apple’s MIE remains a major defense architecture, and Calif has not published enough detail for outsiders to independently evaluate the exploit chain. But the public claim alone shows that AI-assisted security research is no longer a theoretical policy debate; it is now playing out against flagship consumer hardware in real time.