Originally published at: What Anthropic’s Mythos and Project Glasswing Mean for Your Apple Devices - TidBITS
Anthropic, the company behind the Claude AI chatbot, made two security announcements that were shocking for many but seen as inevitable by those of us working in AI security. First, it announced Mythos Preview, a new, non-public AI model that turns out to be startlingly good at finding security flaws in software. The second was Project Glasswing, Anthropic’s program for getting that capability into the hands of the companies best positioned to fix those flaws before anyone else can exploit them. Apple is one of those companies.
As much as I’d like to downplay the announcements, Mythos and Project Glasswing are very big deals on their own, and harbingers for the future of digital security. Mythos was able to find and exploit new vulnerabilities in every major operating system, including a bug in OpenBSD, an operating system famous for its security, that had been sitting there unnoticed for 27 years. (If OpenBSD sounds familiar, it’s because Apple’s operating systems have roots in versions of BSD.) For now, the problem is contained. Only Anthropic has Mythos. But there’s no reason others can’t develop these capabilities, starting with nation states, and eventually filtering down to lower-resourced operations like criminal organizations.
Mythos matters. And while, as consumers, there isn’t a lot we can do, understanding the implications helps us prepare for the future and might even affect our buying decisions. Here’s what happened, and more importantly, what it means for the devices on your desk and in your pocket.
Is Mythos the Kind of AI Anyone Can Download and Run?
No. This is the single most important thing to understand before you read any of the louder headlines. Mythos isn’t a program you can copy onto a laptop. “Frontier AI models”—those at the cutting edge—like this one run on massive, purpose-built computing infrastructure that costs a fortune to build and operate. (The thousand tests against OpenBSD consumed nearly $20,000 worth of compute.) Anthropic can see who is using it, control what they can ask it to do, and shut down abuse. That’s exactly why Project Glasswing can work: Anthropic is handing Mythos to a small group of trusted partners, including Apple, so they can find and fix flaws in their own software before anyone hostile has a comparable tool.
Over time, similar capabilities will appear in other AI models, and some version will eventually leak into the wild. But we aren’t there today, and the defenders have a (temporary) advantage.
What Does This Mean for Apple?
Apple products have a structural advantage over other general-purpose consumer computing devices: Apple controls the entire stack, from the silicon in the chip to the operating system to the App Store to iCloud services. It’s called vertical integration (and is also sometimes a source of consternation, since that means it’s a closed ecosystem). When Apple decides to add a new security defense, it can build it into the chip, wire it into the operating system, and require its use in apps (in iOS, macOS is a different story). Most of the industry cannot do that. With Windows, Microsoft has to work with Intel and AMD and a thousand PC makers. With Android, Google has to coordinate with Qualcomm and Samsung and dozens of other phone manufacturers.
Apple has been quietly using that advantage for years. The Apple Platform Security Guide documents the company’s primary security controls, including how they tie hardware and software together. Defenses include tools such as the Secure Enclave, Pointer Authentication, Kernel Integrity Protection, and other esoterically named defenses that provide real-world benefits. Other ecosystems also leverage similar hardware-to-software security ties, but it’s typically messier and less consistent. For example, Microsoft has Pluton, its own custom security processor designed in partnership with AMD, Qualcomm, and Intel. But Pluton is optional and sometimes disabled by PC manufacturers, whereas Apple consistently builds its protections into all its platforms.
Apple’s newest (and exciting for us security nerds) addition is Memory Integrity Enforcement, and Apple calls it “the most significant upgrade to memory safety in the history of consumer operating systems.” That’s a strong claim, but not unreasonable. It ships with the A19 and A19 Pro chips, which means every iPhone 17 and the iPhone Air got it at launch, and it’s also coming to Macs with the M5 chip and later. Apple’s own write-up describes it as the culmination of roughly five years of engineering work.
Anthropic focused its Mythos testing on memory-related attacks. These are consistently one of the primary sources of serious security vulnerabilities. Apple’s Memory Integrity Enforcement tags memory at the hardware level so the chip itself refuses to let a program read or write memory that doesn’t belong to it. I have no idea if Mythos bypassed Memory Integrity Enforcement, but I suspect Apple’s protections helped. Memory Integrity Enforcement is, however, limited to Apple’s latest devices. And memory corruption attacks are only one of many families of security vulnerabilities.
How Worried Should I Be?
Mythos is concerning and will have implications across every technology you use. We are approaching a point where vulnerabilities and exploits are developed faster than humans can respond, and the tools find flaws humans miss. My advice is to be aware and be prepared to make changes to how you select and manage your personal technology. You’ll want to prefer newer devices and services with good track records of staying up to date.
Apple is already a Project Glasswing partner, alongside Google, Microsoft, Amazon, the Linux Foundation, and more than 45 other organizations. They get early access to Mythos-class tools to find and fix their own bugs before anyone else can use similar capabilities. iOS and iPadOS are relatively locked-down environments where every app must be reviewed, signed, and run inside a sandbox that limits what it can access. Combine that with Apple’s new hardware protections, and the iPhone and iPad are in about as good a position as any consumer device on the planet right now.
That is not the same as invulnerable. Nothing is invulnerable, as DarkSword shows (see “DarkSword Exploit Threatens iPhones Still Running iOS 18,” 23 March 2026). But the combination of a controlled ecosystem, hardware protections, and a head start on Project Glasswing puts iOS in a much better spot than most platforms. The attack surface isn’t infinite, and Project Glasswing (along with Apple’s ongoing security efforts) will likely dramatically reduce the number of potential vulnerabilities across Apple’s platforms.
The primary objective of Project Glasswing is to find and fix as much as possible across major platforms, services, and vendors before adversaries gain these offensive capabilities. Then companies like Apple can include Mythos-level assessments into their process as they build new things, closing the vulnerabilities before they ever go out the door.
What About Macs?
The Mac is a more complicated story.
Macs are designed to let you install and run a huge range of software from anywhere, not just the App Store. Macs need this versatility, but that same openness is what makes the Mac a tougher security problem than the iPhone. The more software you can run, and the more freely that software can interact with the rest of your system, the more surface area attackers can target.
Apple has been quietly tightening security on the Mac for years, and modern Macs running recent versions of macOS are far more hardened than most people realize. Gatekeeper, System Integrity Protection, and the signed system volume all work to keep the core operating system from being tampered with. More importantly, every Mac with Apple silicon, meaning the M1 and every chip since, inherited a large chunk of the same hardware security architecture Apple built for the iPhone: the Secure Enclave, Pointer Authentication, Kernel Integrity Protection, the Page Protection Layer, secure boot anchored in hardware, and isolated execution for sensitive system code. An Apple silicon Mac is, at the hardware level, dramatically better protected than an Intel-based Mac ever was. And Memory Integrity Enforcement, the same protection I described above for the iPhone 17 lineup, is now landing on Macs with the M5 chip and later, extending that ladder one more rung on the Mac side of the house.
But if you are thinking, “I should do something different on my Mac than on my iPhone,” you’re right. On your iPhone, the system is doing most of the work for you. On your Mac, you still need to be thoughtful about what you install and where it came from, because the Mac’s openness means some of the protections iOS takes for granted are opt-in. Macs also allow you to turn off some of their defenses, and that isn’t a good idea.
What Should I Actually Do?
First, and by a wide margin: keep your devices up to date. This is the single most important thing, and it is not new advice. The entire point of Project Glasswing is that fixes will start landing in Apple’s updates. Those fixes only help you if you install them. An older iPhone that’s being patched regularly is in much better shape than a brand-new one that isn’t. Turn on automatic updates on your iPhone, iPad, and Mac, and actually reboot when asked.
Second, understand that newer hardware gets you better protection than older hardware. One reason I upgraded to the iPhone Pro 17 was to get Memory Integrity Enforcement (I suspect I’m in the minority). This isn’t mere marketing; it’s how security works when protections are built into the chip. Every iPhone 17 and the iPhone Air already ship with Memory Integrity Enforcement, and Macs with the M5 chip and later are getting it too. If you’re on an M1, M2, M3, or M4 Mac, or any iPhone older than the iPhone 17 series, you do not have Memory Integrity Enforcement, but you do have the rest of Apple’s hardware security architecture that’s been accumulating since 2018. You are not suddenly insecure overnight; you just don’t have the latest protections.
If you are already planning to upgrade in the next year or two, that upgrade will give you meaningfully better protection against the kinds of attacks Mythos makes easier to build. That said, if you are using old hardware that’s no longer supported, it’s time to upgrade.
Being the tech guy for a family of five, I won’t be able to get everyone on all the latest hardware, but I’ve already been deprecating any pre-Apple silicon devices, will upgrade to M5 Macs for myself over the next year, and will be upgrading the kids’ iPhones more frequently than usual.
Third, be thoughtful about which apps you install and, more importantly, what data you give them. Here is the part most people miss. Even with Apple’s hardware protections and iOS sandboxing, the apps themselves are written by thousands of small developers, most of whom lack Apple’s resources to find and fix their own bugs. The App Store review process catches some bad actors, but it is not designed to find subtle security flaws, and compromised code libraries have made their way into legitimate apps before.
On top of that, most apps talk to cloud services run by small teams, and any data you give an app often ends up on those servers, too. Sandboxing on iOS does a good job of containing a misbehaving app so it can’t take over your whole phone, but it can’t protect data you have already handed to a company that then stores it on its own systems. So think twice before you give a random app access to your photos, contacts, health data, or financial information.
Stick to well-known, reputable apps for anything sensitive. Use Apple’s built-in privacy controls. When an app asks for permission to do something it doesn’t obviously need, say no. And if you’re not actively using an app, delete it. Every app you remove is one less thing for a future Mythos-class tool to find flaws in.
The Bigger Picture
We are at the start of a period in which finding software flaws that affect everyday users will become dramatically easier for both attackers and defenders. The situation for enterprises like banks, hospitals, and retailers is worrisome. These organizations have massive amounts of legacy code and software in their data centers that will be much harder to update and defend. This is why Project Glasswing includes financial institutions and other critical infrastructure companies, not just software and hardware vendors. As consumers, this is where we face our greatest risks, but it’s up to those organizations to protect us.
However, over the long run, I believe using AI to identify security vulnerabilities favors defenders, because developers can find and fix many more bugs before shipping software to the public. And AI coding tools may help us develop new defensive security techniques that eliminate entire attack categories, especially when those writing the software control the entire stack, as Apple does.
With respect to our Apple devices, we’re in a pretty good position. Apple is part of Project Glasswing and has quietly been building robust security protections for years. Keep your stuff updated, be thoughtful about who and what you trust with your data, and let Apple do what Apple is good at. This is a time to pay attention, not be afraid.
Rich Mogull is the TidBITS Security Editor, the Chief Analyst at the Cloud Security Alliance, and has spent more than 25 years working in information security. He is not compensated by Apple or any other company mentioned in this article.
