Apple’s July 27 security update blitz came with an unusual addition to its credit pages: the company publicly acknowledged Anthropic’s Claude, OpenAI’s Codex, and other AI tools as contributors to vulnerability discovery across iOS 26.6, macOS Tahoe 26.6, and related platform updates.
The credits appear in Apple’s official security documents for multiple components. Anthropic researchers and Claude are named for fixes involving WebKit, WebKit Storage, and WebDAV, often listed alongside human researchers from Calif.io – the same team that publicly demonstrated a working macOS kernel memory corruption exploit built with Anthropic’s Mythos Preview model in just five days back in May.
Codex Security researchers, working with OpenAI’s Codex, also earned credit for AI-assisted discoveries in WebKit Canvas. In total, Apple addressed 30 distinct kernel CVEs across the 194 CVEs spanning all operating system updates released that day.
Apple has had access to Claude Mythos Preview through Anthropic’s Project Glasswing program since April, meaning the number of internally discovered vulnerabilities aided by AI tools may be higher than the public acknowledgments suggest. The company has not disclosed the total volume of AI-assisted findings.
The inclusion of AI tools in security credit sections marks a shift in how Apple documents vulnerability origin. AI-assisted bug hunting has drawn both praise for accelerating discovery and criticism over reliability. A May demonstration showed Claude helping bypass Apple’s MIE hardware protections – underscoring how the same technology now earns formal acknowledgment in Apple’s security advisories.
Apple plans to release iOS 27 and macOS Golden Gate later this year, with stricter network security requirements that could reshape how future vulnerabilities are discovered and credited.
