Apple released macOS Tahoe 26.5 on May 11, 2026, addressing a number of security vulnerabilities, including one in the kernel (CVE-2026-28952) that was reportedly found with the help of the Claude AI model. This marks a notable instance of AI contributing directly to vulnerability discovery in a major operating system.
What Happened
Apple's security release notes detail several vulnerabilities addressed in macOS Tahoe 26.5. CVE-2026-28952 specifically addresses an out-of-bounds read in the kernel, corrected with improved bounds checking. Apple doesn't typically disclose details of vulnerabilities before a patch is available, but confirms that Claude was involved in identifying this specific issue. The release also addresses a wide range of other vulnerabilities including buffer overflows, permission issues, sandbox escapes, and memory corruption flaws (CVE-2026-28991, CVE-2026-28988, CVE-2026-28959, CVE-2026-28995, CVE-2026-1837, CVE-2026-28956, CVE-2026-39869, CVE-2026-28922, CVE-2026-28936, CVE-2026-28918, CVE-2026-28915, CVE-2026-43659, CVE-2026-28923, CVE-2026-28925). Researchers from multiple organizations contributed to the findings, including Seiji Sakurai, Asaf Cohen, Vamshi Paili, and others.
Why It Matters
The involvement of AI in vulnerability discovery is a significant development. While security researchers have long used automated tools, the application of large language models (LLMs) like Claude to proactively identify potential flaws represents a new approach. The discovery of CVE-2026-28952 suggests AI can augment human security analysis by identifying edge cases or subtle bugs that might be missed during traditional code review.
For developers, this could mean a shift in security practices. We may see increased use of AI-powered static analysis tools, and potentially even AI agents involved in fuzzing or other vulnerability research techniques. For macOS users, the release highlights the ongoing need for timely security updates. The kernel is a critical component of the operating system, and vulnerabilities at this level can have severe consequences.
What To Watch
It’s currently unclear how Claude specifically identified the vulnerability. Apple has not released details about the AI’s methodology. Future reports could shed light on the AI’s role and the types of vulnerabilities it is best suited to detect. It will be important to observe whether AI-assisted vulnerability discovery becomes more common and whether it leads to a decrease in the number of zero-day exploits. Furthermore, it remains to be seen how effectively AI can be used to identify vulnerabilities in other complex software systems.