Apple has released major security updates for iOS , macOS , and the Safari browser ( iOS 26.5.2 , macOS Tahoe 26.5.2 , and Safari 26.5.2 ), patching more than 30 vulnerabilities , including four critical flaws in WebKit that were discovered using artificial intelligence tools. Notably, for the first time in the company’s history, WebKit was scanned by AI models, including Anthropic Claude and OpenAI Codex Security , marking a new era in software vulnerability detection. The move comes in response to growing concerns that artificial intelligence could dramatically accelerate the development of malicious hacking tools.
iOS 26.5.2, macOS Tahoe 26.5.2 and Safari 26.5.2: Apple fixes vulnerabilities
The four vulnerabilities discovered by AI concern critical issues in the web rendering engine. CVE-2026-43707 is a memory corruption issue that can lead to an unexpected process termination when processing malicious web content — it was addressed with improved memory handling. CVE-2026-43716 can cause Safari to crash unexpectedly , while CVE-2026-43745 is an out-of-bounds write that also leads to a browser crash. All three were discovered with the help of OpenAI Codex Security .
See also: Apple fixes WebKit vulnerability in iOS, iPadOS, and macOS
CVE -2026-43715, a use-after-free issue that can lead to memory corruption, was discovered by AnthropicMilad Nasr and Nicholas Carlini, with help from Claude.
The company also fixed CVE-2026-43720, a use-after-free issue in WebKit Canvas, as well as CVE-2026-43725, a vulnerability that could allow a malicious website to process restricted web content outside of the sandbox.
At the same time, Apple fixed three bugs affecting the operating system kernel: CVE-2026-43722 and CVE-2026-43724 — discovered by security researcher Hyunwoo Kim, known for discovering Dirty Frag — as well as CVE-2026-39868, which can lead to kernel memory corruption.
See also: Apple fixes Safari WebKit zero-day flaw
The updates are available for iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2 , and Safari 26.5.2. According to Apple, none of the patched vulnerabilities have been reported as being actively exploited. However, the company emphasized that it is releasing the updates earlier than usual precisely because artificial intelligence can compress the time window between discovery and exploitation of a vulnerability.
WebKit and AI: A New Era in Cybersecurity
The use of AI tools to detect vulnerabilities in WebKit represents a significant breakthrough in the cybersecurity industry. Researchers from Google and Microsoft had already reported during 2025 the use of AI models to detect over 50 unknown vulnerabilities in open source libraries. Apple is now following this trend, integrating Claude and OpenAI Codex Security into its security review process. Industry experts estimate that AI-based vulnerability discovery will soon become an industry standard, but at the same time warn of the dangers: the same tools can be used by malicious actors to automate attacks.
See also: Safari and Apple Intelligence: What was announced at WWDC 2026
To protect against these vulnerabilities, users and organizations should take immediate action. First and foremost, upgrading to iOS 26.5.2, macOS Tahoe 26.5.2 , and Safari 26.5.2 is absolutely essential. Enabling automatic updates significantly reduces the time of exposure to new vulnerabilities. In addition, using web filtering to block malicious content and regularly training staff to recognize phishing are key defenses. Apple has made it clear that it intends to continue to accelerate the release cycle of security updates, recognizing that the era of AI is fundamentally changing the rules of the cybersecurity game.
