Summary
Apple has released out-of-band security updates for iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2, patching nearly 30 vulnerabilities — including four WebKit flaws that were discovered using AI tools from Anthropic Claude and OpenAI Codex Security. The accelerated release breaks Apple’s usual practice of bundling fixes with major software updates.
The patched WebKit vulnerabilities include CVE-2026-43707 (memory corruption), CVE-2026-43716 (unexpected crash), CVE-2026-43745 (out-of-bounds write), and CVE-2026-43715 (use-after-free leading to memory corruption). Additional kernel-level bugs were also addressed that could lead to state leaks, crashes, or memory corruption.
Apple explicitly stated that the rushed timeline was motivated by concerns that AI can rapidly accelerate exploit development from known vulnerabilities, compressing the window between disclosure and weaponization.
Sources
Commentary
This is a watershed moment. Apple — one of the most disciplined companies when it comes to release schedules — is now breaking its own cadence specifically because AI is collapsing the timeline between vulnerability discovery and exploit weaponization. That’s not a theoretical concern anymore; it’s driving real engineering and release decisions at the world’s most valuable company.
The fact that AI tools discovered four of these WebKit flaws cuts both ways. Defenders using AI to find bugs faster is great, but the implication is clear: if Claude and Codex can find these, so can adversaries running the same class of models. The vulnerability research arms race just got a turbo boost, and every organization needs to be patching faster than ever.