California team details how Anthropic Mythos helped them build a working macOS exploit in 5 days

The team behind the macOS kernel memory corruption exploit first published on M5 silicon has shared the latest details on how Mythos Preview helped circumvent a five-year Apple security effort in five days.

About the technical background

Last year, Apple introduced Memory Integrity Enforcement (MIE), a hardware-assisted memory safety system designed to make memory corruption exploits much harder to perform.

As Apple explains, MIE is essentially built on Arm’s Memory Tagging Extension (MTE), a 2019 specification that acts “as a tool in the hardware to help find memory corruption bugs.”

Apple is:

MTE is essentially a memory tagging and tag checking system, where all memory allocations are tagged as secrets. The hardware ensures that subsequent requests for access to memory are only granted if the request contains the correct secret. If the secrets do not match, the app will crash and an event will be logged. This allows developers to quickly identify memory corruption bugs as they occur.

The problem is that Apple realized that MTE wasn’t robust enough under certain circumstances, so they developed MIE and built it into “Apple hardware and software for all iPhone 17 and iPhone Air models.”

In summary, MIE is Apple’s hardware-assisted memory safety system. It is built on Arm’s MTE specification and uses the chip itself to detect and block certain memory corruption attacks before they can be exploited.

Click here for more information about MIE.

Introducing the California team

Early morning today, wall street journal We reported on the fact that California security researchers used Anthropic’s Mythos Preview model to expose a new security vulnerability in macOS by linking “two bugs and a small number of techniques to corrupt Mac memory and gain access to parts of the device that should not be accessible.”

Now, the team behind the exploit has shared some additional details about how it is executed, including a 20-second video showing the kernel memory corruption exploit in action.

In the post, they point out that while Apple has focused most of its MIE efforts on iOS, it recently brought iOS to the MacBook with the M5 chip.

This is California.

Apple took five years to build (MIE). It will probably cost billions of dollars. According to their research, MIE disrupts all public exploit chains against modern iOS, including the recently leaked Coruna and Darksword exploit kits.

They then comment on how they beat M5’s MIE in just 5 days.

Our macOS attack vector was actually an accidental discovery. Bruce Dang discovered the bug on April 25th. Dion Brazakis joined California on April 27th. Josh Maine built the tool and created a working exploit by May 1st.

This exploit is a data-only kernel local privilege escalation chain targeting macOS 26.4.1 (25E253). It starts from an unprivileged local user, uses only normal system calls, and exits with a root shell. The implementation path includes two vulnerabilities and several techniques, targeting bare metal M5 hardware with kernel MIE enabled.

They have a 55-page technical report on the hack, but they say they won’t release it until Apple ships a fixed version of the exploit.

However, they broadly point out that Anthropic’s Mythos Preview model helped them identify bugs and supported them throughout the collaborative exploit development process.

Mythos Preview is powerful. Once you learn how to attack one class of problems, you generalize to almost all problems in that class. Mythos quickly discovered the bug because it belongs to a known bug class. However, since MIE is a new best-in-class mitigation, it can be difficult to bypass it autonomously. This is where human expertise comes in handy.

One of our motivations was to test what is possible when you combine the best models with experts. The successful exploitation of kernel memory corruption in one week against the best protection is noteworthy and says something strong about this combination.

In the post, they also said that this discovery led them to visit Apple Park, where they shared vulnerability research reports directly with Apple.

They also note that Apple’s MIE, like most security mitigations in use today, was built “in a world before Mythos Preview,” in an era when even small teams can make discoveries like this with the help of AI.

Click this link to read Calif’s full post.

Worth checking out on Amazon