Apple May 2026 advisories credit Claude-assisted kernel and WebKit reports

Apple's May 2026 security advisories credit Calif.io and Anthropic researchers working with Claude for a kernel root-privilege issue and a WebKit issue.

Bug class: Kernel privilege escalation and WebKit browser vulnerability
Affected codebase: Apple kernel, WebKit
Credited system: Claude / Anthropic Research
Disclosed: May 11, 2026
Attribution: Direct source attribution
Severity: high

Source status: Apple's May 2026 security advisories credit Calif.io in collaboration with Claude and Anthropic Research for CVE-2026-28952, and Milad Nasr and Nicholas Carlini with Claude, Anthropic for CVE-2026-28942.

Summary

Apple’s May 2026 advisories add two direct Claude-related credits:

CVE-2026-28952, a kernel issue where an app may be able to gain root privileges.
CVE-2026-28942, a WebKit issue credited to Milad Nasr and Nicholas Carlini with Claude, Anthropic.

Attribution

This entry is direct because Apple itself provides the reporter credits and names Claude in both cases. The affected products span iOS, iPadOS, macOS, and related Apple platforms depending on the advisory page.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.