Apple pushed out emergency security updates on Monday, addressing more than 30 vulnerabilities across iOS, macOS, and Safari. The patch batch includes four critical WebKit flaws, three of which were discovered using artificial intelligence—specifically Anthropic's Claude and OpenAI's Codex Security models.
One of the most severe is CVE-2026-43707, a memory corruption issue in WebKit that could allow remote code execution. The AI-discovered bugs highlight a growing trend of using large language models to identify subtle memory safety issues that traditional fuzzing might miss.
All four WebKit vulnerabilities can be triggered by simply processing malicious web content, making them particularly dangerous for users who browse untrusted sites. Apple confirmed the issues affect Safari on both macOS and iOS, as well as any third-party browser that relies on Apple's WebKit rendering engine.
Users are urged to update to iOS 16.7, macOS Ventura 13.6, and Safari 16.6 immediately. No active exploitation has been reported in the wild yet, but the severity of the memory corruption bugs means attackers are likely reverse-engineering the patches now.
Apple credited AI security research teams at both Anthropic and OpenAI for discovering the bugs, signaling a new frontier in vulnerability research where machine learning models assist human analysts in finding zero-days at scale.