AI and the exploit clock: sorting Calif’s 2026 claims

The claims, in order

In April, Calif published the first part of a write-up saying it used an AI model to take apart an existing Safari exploit, adapt it to run on a Mac, and write a variant of its own. The portion available to us carries little technical detail[S1].

In May, Calif said a small team, helped by an AI model for bug finding and exploit development, built a data-only kernel exploit that takes an unprivileged user to root on macOS 26.4.1 running on M5 hardware with Apple’s kernel memory protection enabled. Calif says it found the bugs on 25 April, had a working exploit on 1 May and handed Apple a 55-page report in person[S2]. This is macOS, not iPhone, and it is not evidence of a bypass on an iPhone. In July it published a challenge built on two bugs it says Apple fixed in macOS 26.6: a type-confusion flaw in the SMB client and a flaw in WebDAV that returned uninitialized kernel memory[S3].

In September, Calif said it built, with AI assistance and in about two days, a zero-click exploit for WeChat that needs only an incoming call, and that its demonstration spread from account to account. It says it reported the flaw to Tencent, which it says mitigated it for all users on the server side[S4]. There is no CVE and no software version, and this is a demonstration, not a campaign.

The argument behind the claims

At the Hexacon conference in Paris on 16 October, Calif’s opening keynote abstract argued that 2026 changed vulnerability research because AI models can audit very large code bases without tiring. The speakers say that disclosure, detection and response, and software updating may all need to change[S9].

A Calif researcher quoted by Heise on 19 October was more measured: AI helped, the researcher said, but a model cannot yet simply be pointed at an iPhone[S10]. Each of these statements is Calif’s. We hold them as testimony, not as findings.

Our assessment: what AI changes, and what it does not

Calif’s own dates give the clearest picture of the change it claims. Bugs found on 25 April, a working exploit on 1 May: six days from discovery to exploit for one kernel chain on one Mac[S2]. These are Calif’s dates and no one has reproduced them. If they are typical of what AI-assisted teams can do, the stage that shortens is the front of the pipeline, finding bugs and turning them into working code.

The back of the pipeline has not obviously sped up. A vendor still has to ship a fix, and an owner still has to install it. That asymmetry is the strongest argument for prompt updating, and it holds whether or not Calif’s claims about AI are fully borne out. It is also why we treat the claims as a reason to tighten routine, not as a reason for alarm.

What can be checked

Two things in the record rest on someone other than Calif.

The first is Apple’s own list. Its iOS 27 security notes credit Calif.io in four entries: a video-encoder component and a core framework (both in a credit line that names an AI model and its developer), a kernel memory-corruption entry and an entry on protected files. The impacts are the kind that crash or corrupt a phone: unexpected system termination, denial of service, memory corruption and modification of protected system files. None is flagged as exploited[S8]. Apple does not link them to the Paris demonstrations, and neither do we.

The second is a clock. Apple fixed a CoreGraphics flaw in iOS 26.7.1 on 28 September, saying it may have been used in an extremely sophisticated attack on specific people on versions before iOS 27[S12]. On 30 September Calif published an analysis built from comparing iOS 26.7 with 26.7.1, locating the fix in the glyph rasterizer, plus a PDF that crashes unpatched iPhones and Macs [S6][S11]. We have not seen Calif say that an AI model assisted this analysis, and one claim in its first version about how a file could reach a phone was removed about 85 minutes after publication, according to The Hacker News[S11].

This is one example, not a trend. It shows that reading a patch can lead quickly to a crash, which is the first step toward an exploit.

What cannot be checked

No bug list, tool or timeline for the Paris demonstrations has been published; Calif’s newsletter names four demonstrations and promises release "in due time"[S7]. Heise reports a Calif researcher saying that most of the chain’s bugs are already fixed in an iOS 27.2 beta[S10]. Apple has published nothing to confirm it. We do not state that any named component is vulnerable today.

Calif also reported a dormant Endpoint Security extension in the iOS 27.2 beta, which it says stays inactive on retail iPhones and can only observe, not block[S5]. The conclusion comes from disassembly and, by Calif’s own caveat, is partly inferred. If it holds, third-party security apps still cannot watch iPhone system events live, and analysis rests on stored data.

How to read the scoreboard

Of the six claims in Figure 2, five are Calif’s own, and four of those have not been verified by anyone else. That does not make them false. Apple credits Calif in its own notes, which is the strongest evidence that the firm’s work is real. But a claim that cannot yet be checked should be reported as a claim. We will move a row to "verified" only when Apple, a CVE record or an independent group does it.

What the Lab is watching

We are watching three things.

First, the time between a vendor fix and a public exploit-grade artifact. Google’s Threat Intelligence Group counted 15 mobile operating system zero-days in 2025, after 9 in 2024 and 17 in 2023, and noted that several chains included three or more flaws[S13]. Longer chains lengthen the work even when tools get faster, so speed may help attackers less than headlines imply.

Second, whether Calif releases details and whether Apple’s notes grow a matching entry.

Third, whether independent groups reproduce any of these claims.

What this means for examiners

Update promptly. If a patch comparison can yield a crash file in two days[S11], the window in which an unpatched phone is easy to probe is short. Record each phone’s version before any change is made to it, so you can say what it was exposed to.

Treat any headline about an "AI-built exploit" as unverified until a vendor advisory, a CVE or an independent group confirms it. Ask what version the phone ran and when it was last updated; that answer is useful whatever the headline turns out to mean.

Faster exploitation does not change what a phone keeps. Crash records, installed apps and network history remain the evidence, subject to their usual limits. If anything, the lesson of 2026 is that the evidence window matters more, not less: a phone updated in haste may lose the very records an examination would have used.

What we could not confirm

We could not confirm Calif’s technical claims, the role of AI in each, or any link between Apple’s four credits and the Paris demonstrations.