According to Chrysalis Beating monitoring, the security research team Calif announced that they successfully built the first public macOS kernel memory corruption exploit chain on a Mac device equipped with the M5 chip using Anthropic's unreleased Mythos Preview model. MIE (Memory Integrity Enforcement) is a flagship hardware security mechanism developed by Apple for the M5 and A19 chips. Apple spent five years and billions of dollars on this mechanism, designed not to be hacker-proof, but to mitigate memory corruption vulnerabilities by significantly increasing the exploitation cost. The Calif team discovered the flaw and completed the exploit in just five days.
This attack chain consists of two vulnerabilities and multiple techniques, starting from a non-privileged local standard user, relying only on regular system calls, and ultimately gaining root access to the device. This exploit chain is a data-driven kernel local privilege escalation that directly targets macOS 26.4.1 bare-metal real hardware with the kernel MIE mechanism enabled.
The Mythos model excels in quickly generalizing to similar problems after learning a specific type of attack. It helped the team rapidly identify defects belonging to known vulnerability classes, which were then overcome by human experts to bypass new hardware defenses. This breach validation demonstrates the efficient combination of "AI discovering vulnerabilities + experts bypassing defenses" and proves that with the assistance of a top-tier large model, a small security team is capable of challenging the technological barriers established by large companies at a significant cost.
