Last week, Calif.io rebooted an iPhone 18 Pro on stage in Paris and the jailbreak came back on its own, the first untethered demo since the iOS 9 era. It was a milestone, but it was not a beginning. Five months earlier, the same firm had already shown what its researchers and their AI partner can do.
Five days from first bug to a root shell
On May 14, 2026, Calif disclosed the first public macOS kernel exploit on Apple’s M5 silicon. The target was macOS 26.4.1, build 25E253, running on bare-metal M5 hardware. Researchers Bruce Dang, Dion Blazakis, and Josh Maine chained two previously unknown macOS bugs into a local privilege escalation that started from an ordinary, unprivileged user account and ended with a full root shell, using only normal system calls. It worked while Apple’s newest hardware memory protection was fully enabled.
The timeline, per Calif’s own writeup, is what made the security press pick it up. Dang found the bugs on April 25. Blazakis joined the team on April 27. Maine built the tooling. By May 1, the team had a working exploit. From no bugs in hand to a root shell in five days, against one of the hardest targets in consumer computing.
Memory Integrity Enforcement: Apple’s five-year wall
The mitigation they beat was not a paper defense. Apple introduced Memory Integrity Enforcement, or MIE, in 2025 as a hardware-assisted memory safety system built on Arm’s Memory Tagging Extension. Every memory allocation gets a secret tag, and the hardware only grants access when the request carries the correct one. Apple developed MIE over roughly five years, shipped it across the iPhone 17 lineup, then brought it to the M5 MacBooks, and publicly said it disrupted every known exploit chain against modern iOS.
Calif’s chain beat it anyway, which is why the disclosure landed the way it did. Nine publications across the security and Apple press covered the disclosure within days, and Calif’s response was unusual: instead of filing through Apple’s standard bug bounty pipeline, the team walked a printed 55-page report into Apple Park in person, a deliberate move to keep the findings out of a crowded submission queue. They promised to publish the full technical report once Apple ships a fix.
The AI was a partner, not a solo act
Here is the line that connects May to October. Calif said the M5 exploit was built with substantial help from Claude Mythos Preview, Anthropic’s restricted frontier model for vulnerability research. The model helped identify the two bugs, which fell within known bug classes, and assisted throughout the exploit development. But turning them into a working chain against MIE still required human expertise. Calif chief executive Thai Duong, known in the scene as XorNinja, was explicit about that split: the attack was not the product of AI alone.
That is nearly word for word the credit Calif gave for the Paris jailbreak. On stage at Hexacon, Duong said of the iPhone chain: “We didn’t build the chain alone. Mythos Preview helped identify the bugs and assisted throughout exploit development.” We wrote earlier this week about what that credit line means for the whole industry. The same model, the same pairing of frontier AI with veteran researchers, and the same outcome: a working chain that nobody else had.
Anthropic’s side of this is public too. In April 2026 it launched Project Glasswing, which gives selected partners access to Mythos Preview for defensive cybersecurity work. Anthropic says the model can find and help exploit zero-day vulnerabilities when directed by a user, which is exactly why access stays controlled.
Two crashes in Apple’s own release notes
There is one more data point in the pattern, and it comes from Apple’s own paperwork. The iOS 27 security release notes, published on September 14, credit Calif.io working with Claude and Anthropic Research for two crash bugs. Those two bugs are unrelated to the jailbreak chain, and Apple lists them as fixed. The same combination of human researchers and Anthropic’s models is being credited by Apple for bugs it patched, and by Calif for a chain Apple has not patched yet. Both can be true at once.
A workflow, not a one-off
Put the three events side by side and the picture changes from “stunning demo” to “repeatable workflow.” May: a five-day macOS kernel exploit on M5, disclosed to Apple in person, details held for the patch. September: two crash bugs reported to Apple through the model-assisted pipeline, patched and credited. October: an untethered jailbreak on the newest iPhone and the newest iOS, demonstrated live, details withheld “in due time.”
The constants across all three are a small team of elite researchers, a frontier AI model doing real work in bug discovery and chain building, and a disclosure posture that keeps the details private until Apple can respond. No public tools, no real-world attacks reported, no grandstanding with live weapons.
That posture is also the honest answer to the question everyone keeps asking about the iPhone jailbreak: why has Calif not released it? Look at May. The M5 findings went to Apple first, and the full report is still waiting on a fix. The October demo is following the same playbook.
What comes next: iOS 27.2 and the promised writeup
Two things will test the pattern. The first is iOS 27.2, which reached release candidate stage on October 19 as build 24B115 and is expected publicly next week. Until Apple’s security notes for 27.2 appear, nobody outside Apple can say whether it patches the bugs behind the Paris demo, because Calif has not named them. The second is Calif’s promised writeup. If it arrives with the same technical depth as the May report, it will tell us exactly how much of this chain the model found and how much the humans built. Either way, this stopped being a one-off the day the iPhone rebooted in Paris and the jailbreak came back. It is a workflow, and it is getting faster.
