Researchers at Palo Alto-based Calif used Claude Mythos Preview to build the first publicly disclosed macOS kernel memory corruption exploit on Apple's M5 chip, surviving the company's new Memory Integrity Enforcement protection. The timeline is almost absurd: the full exploit chain came together in roughly five days of work, after Apple had spent five years and an estimated multi-billion-dollar budget engineering the defense it bypassed.
Calif is three people: Bruce Dang, Dion Blazakis, and Josh Maine. Dang found the first bug on April 25. Blazakis joined two days later. Maine built the exploitation tooling, and they had a working chain by May 1. That's not a typo.
As someone who covers AI tooling daily, what stands out here isn't the speed alone. It's what the speed implies about how exploit economics are shifting when a capable model pairs with experts who already know where to look.
What Apple's MIE Actually Does
To understand why this matters, you need to understand what Memory Integrity Enforcement (MIE) is and what it was designed to stop.
MIE is a hardware-assisted memory safety system built on ARM's Memory Tagging Extension (MTE). It was introduced as the flagship defense on the M5 and A19, aimed squarely at memory corruption, the bug class behind some of the nastiest iOS and macOS compromises ever pulled off.
MTE works by assigning a 4-bit tag to pointers and to 16-byte memory granules. When a pointer is dereferenced, the hardware checks if the pointer's tag matches the memory granule's tag. A mismatch triggers an exception, ideally halting the exploit dead in its tracks.
Apple went further than the base ARM spec. The system includes Apple's "Enhanced MTE" (EMTE) and other protections like Tag Confidentiality Enforcement and Secure Page Table Monitor (SPTM). EMTE enforces synchronous checking, meaning any tag mismatch immediately raises an exception, which is far more robust than MTE's asynchronous mode.
By Apple's own research, MIE breaks every publicly known exploit chain against modern iOS, including the leaked Coruna and Darksword toolkits. Until now, that record held.
How the Exploit Chain Works
The exploit is a data-only kernel local privilege escalation chain targeting macOS 26.4.1 (25E253). It starts from an unprivileged local user, uses only normal system calls, and ends with a root shell.
The "data-only" classification is the key technical detail. Standard memory corruption exploits often focus on corrupting pointers, such as buffer overflows or use-after-free vulnerabilities where an attacker overwrites a memory address to redirect execution flow. MIE, via its use of ARM's MTE, is designed to catch these precisely.
Calif's chain works around the check by never touching the operations MIE actually watches. By corrupting kernel data structures rather than pointers, the exploit sidesteps the tag-checking machinery entirely. The data-only nature of the exploit implies that these defenses, while strong against traditional memory corruption, are not foolproof against sophisticated data manipulation.
