Apple’s macOS Security Compromised by New Mythos Vulnerability: Experts Alarmed

Last Month’s Technological Breakthrough by Anthropic

In a recent development, Anthropic showcased its security initiative called Glasswing, which is centered around a new model named Claude Mythos Preview. This model is designed to identify vulnerabilities in operating systems and web browsers. Anthropic has stated that this AI will not be made available to the general public. Researchers at Calif, a California-based security firm, were granted access to utilize this tool and discovered a significant vulnerability in macOS running on Apple’s M5 chip. This chip, similar to the A19, incorporates Memory Integrity Enforcement (MIE) technology, which is supposed to offer robust protection against memory corruption attacks.

Collaboration Between Human Expertise and AI Technology

With the help of Mythos, the Calif researchers were successful in exploiting two vulnerabilities to gain full permissions on the system. This hack allows a standard user to obtain root access and thereby gain control over the system’s keys. The researchers shared their experience, highlighting the synergy between human and machine:

“We did not develop this exploit chain on our own. Mythos Preview helped identify the vulnerabilities and guided us throughout the exploit development process. Mythos Preview is a powerful tool: once it learns to exploit a category of problems, it can adapt to almost any issue within that category. Mythos quickly identified the vulnerabilities because they belong to known categories. However, MIE represents a cutting-edge protection solution that is complex to bypass autonomously. This is where human expertise comes into play. Our aim was also to test the potential of combining top AI models with human expertise. Successfully exploiting a kernel memory corruption despite top-notch protections in just a week is a testament to the effectiveness of this collaboration.”

Engagement with Apple

Two researchers from Calif personally delivered their 55-page report to Apple Park, capturing a commemorative photo for the occasion. They humorously noted, “Most reputed hackers tend to avoid human interactions as much as possible; this direct approach might thus give us a slight edge in the mad dash for five minutes of Twitter fame.” The researchers have stated that they will not publish their findings until Apple has implemented a patch.