# AI Bug Hunters Leave Their Mark on macOS Tahoe 26.6 > Source: > Published: 2026-07-28 12:09:15+00:00 [Security](https://sourcefeed.dev/c/security)Article # AI Bug Hunters Leave Their Mark on macOS Tahoe 26.6 Apple's 155-CVE July update ships no zero-days, but the researcher credits reveal where vulnerability discovery is heading. [Ji-ho Choi](https://sourcefeed.dev/u/jiho_choi) Apple shipped [macOS Tahoe 26.6](https://support.apple.com/en-us/128067) on July 27 with fixes for 155 distinct CVEs — by my count of the bulletin, one of the largest single macOS security drops Apple has ever published. None of them is flagged as actively exploited, which makes this a calm-but-prompt patch rather than a fire drill. The same day brought parallel fixes in macOS Sequoia 15.7.8 and Sonoma 14.8.8, plus iOS and iPadOS 26.6 with close to 90 CVEs of their own. A bulletin this size is worth reading as a dataset, not a changelog. Three patterns in it matter more than any individual bug. ## The credits now include machines Scan the researcher credits and something new jumps out. An SMB kernel type-confusion (CVE-2026-64704) and a WebDAV kernel memory-disclosure (CVE-2026-64703) are credited to Calif.io "in collaboration with Claude and Anthropic Research." A WebKit memory-corruption fix (CVE-2026-64757) credits Milad Nasr and Nicholas Carlini "with Claude, Anthropic." Another WebKit use-after-free lists a finder "Using GLM From Z.AI." A Screen Sharing Server data-exposure bug credits the "Atuin Automated Vulnerability Discovery Engine," and one of the CUPS root-privilege bugs lists NVIDIA's AI Red Team among its finders. That's at least half a dozen entries in a single bulletin where AI systems are named as co-discoverers, across multiple vendors' tooling. A year ago this was a conference-talk novelty. Now it's routine enough that Apple has settled on credit phrasing for it. The practical consequence: the supply curve for memory-safety bugs in legacy C code is bending. Several of these entries carry ten-plus credited researchers for a single CVE — independent rediscovery of the same bugs, which is what a crowded, increasingly automated hunting ground looks like. Expect bulletins to keep getting bigger, and stop reading raw CVE counts as a quality signal in either direction. The number that matters is how much attack surface a vendor retires, not how many bugs it fixes — because the finding rate is no longer the bottleneck. ## The kernel is still parsing 1998's filesystems The single biggest cluster is filesystem parsing in the kernel: seven separate HFS entries, plus cd9660 (ISO images), UDF, AppleDouble, APFS, and four Disk Images fixes. The impacts are the bad kind — mounting a crafted disk image can corrupt kernel memory (CVE-2026-43773), and one HFS bug reaches arbitrary code execution (CVE-2026-28981). There's also a genuinely eyebrow-raising one: a remote buffer overflow in the AFP client (CVE-2026-64767) that can corrupt kernel memory. AFP — a protocol Apple deprecated years ago — still ships, still parses attacker-controlled data, still runs in ring 0. This cluster has appeared, in some form, in nearly every macOS bulletin for years, and it's why attackers love `.dmg` and `.iso` files as delivery vehicles: the parser runs in the kernel and the file format is attacker-controlled. Apple knows the structural fix — it built [FSKit](https://developer.apple.com/documentation/fskit) precisely to get filesystem implementations out of the kernel and into sandboxed user-space processes. But HFS and friends haven't made the trip yet, so the tax keeps getting paid one bounds-check at a time. Until they do, treat "mount this disk image" from an untrusted source as equivalent to "run this binary." ## Your stack ships these bugs too macOS bundles a lot of open source, and this bulletin patches a swath of it: Apache, [curl](https://curl.se) (CVE-2026-3783 and CVE-2026-3784, where authentication credentials can be sent to a server on another origin), libarchive (process memory disclosure), Net-SNMP, Heimdal, xar, and two root-privilege escalations in [CUPS](https://openprinting.github.io/cups/). If you build backend software, those same components are in your containers and CI images, and Apple's bulletin is effectively a reminder that upstream fixed them — on upstream's schedule, not Apple's. The curl credential-leak pair is the one to chase: curl is in practically every base image and every language's HTTP tooling lineage. Check what version you're pinning, because a bug that leaks credentials cross-origin in a redirect-following client is exactly the kind of thing that bites a CI pipeline quietly. ## What to actually do For your own machines and any fleet you manage, `softwareupdate --install --all` or your MDM's enforcement window — and the calculus here is about N-days, not zero-days. Nothing in this release was exploited in the wild before the patch, but Apple's bulletins are a public diff map. With 155 CVEs including remotely reachable kernel bugs in SMB, NFS, and AFP, patch-diffing starts the day the update lands. Sequoia and Sonoma got parallel fixes, so "we're one major version behind" is not an excuse this cycle. If you ship a Mac app, two items deserve more than a shrug: **Media parsing is your liability window.** ImageIO (six entries), Model I/O (seven), and SceneKit all fixed code-execution or memory-corruption bugs reachable by "processing a maliciously crafted file." If your app opens untrusted images or 3D assets through these frameworks, every unpatched user's machine is exploitable through*your*file-open dialog. Parse in a sandboxed XPC helper with a minimal entitlement set; that turns a framework RCE into a crash in a throwaway process.**Distribution defenses had holes.** A Gatekeeper bypass via DesktopServices (CVE-2026-64708) and a quarantine kernel bug got fixed. Notarization and Gatekeeper are probabilistic controls, not walls — keep your own update channel signed and pinned rather than leaning on the platform to referee. The honest verdict: this is a good release with no scandal in it — Apple fixing a mountain of bugs, most found by an increasingly industrialized research community, human and otherwise. The uncomfortable part is the trend line. When AI-assisted discovery shows up this visibly in one vendor's credits, it's finding the same bug classes in everyone else's C code too, and not every finder files a report. The vendors that come out ahead won't be the ones that patch fastest; they'll be the ones that move parsers out of the kernel so there's less left to find. ## Sources & further reading - [About the security content of macOS Tahoe 26.6](https://support.apple.com/en-us/128067)— support.apple.com - [Update Now: iOS 26.6 and macOS Tahoe 26.6 Patch Hundreds of Security Flaws](https://www.macrumors.com/2026/07/27/ios-26-6-security-fixes/)— macrumors.com - [OS 26.6 Delivers Massive Number of Security Fixes](https://tidbits.com/2026/07/27/%EF%A3%BFos-26-6-delivers-massive-number-of-security-fixes/)— tidbits.com [Ji-ho Choi](https://sourcefeed.dev/u/jiho_choi)· Security & Cloud Editor Ji-ho covers the increasingly tangled overlap between cloud architecture and security, drawing on a background as a penetration tester to keep his reporting grounded in real-world attack paths. He never lets a vendor claim go unquestioned and insists that every buzzword come with a proof of concept. ## Discussion 0 No comments yet Be the first to weigh in.