Apple iOS 26.6: Anthropic used Claude to find a Safari flaw

Two research scientists at Anthropic found a security hole in Safari, and they found it with Claude, the AI model built by their own employer. Apple closed the hole on Monday with iOS 26.6 and iPadOS 26.6 and names the model in its acknowledgments. In total the update fixes 87 vulnerabilities, listed across 78 entries, covering the kernel, Safari, image processing and Contacts.

Apple does not flag a single one of them as already exploited. That was the case in late June too, when Apple pulled the release of iOS 26.5.2 forward because AI tools shorten the path from a patch to a working attack.

The name of the tool sits in the advisory

Apple credits CVE-2026-64757 verbatim to "Milad Nasr and Nicholas Carlini with Claude, Anthropic". CVE stands for Common Vulnerabilities and Exposures and is the globally uniform number for a reported flaw. Nasr and Carlini both work as research scientists at Anthropic. Carlini moved there from Google DeepMind in 2025.

The bug sat in WebKit, the browser engine behind Safari and behind every app that displays web content. The two found a memory corruption issue there that let specially crafted web content crash Safari. The same names show up a second time under WebKit Storage, the part of the engine that stores data from websites on the device.

The unusual part is not that an AI was involved. It is that Apple names it. The acknowledgments normally list people and companies, not tools. How large Claude's share of the find actually was, neither Apple nor Anthropic says. In early July we had the opposite case: Bad Epoll, a root vulnerability that Anthropic's AI had missed.

Why your iPhone runs warmer now

The second part of the update is invisible and still noticeable. Apple's release notes spend a single sentence on the contents: the update brings bug fixes, security updates and optimizes the Spotlight index in preparation for iOS 27. Spotlight is the device-wide search. Apple is rebuilding that index now so the reworked search and the more deeply integrated Siri are ready to run in the fall.

That costs processing time, and Apple says so itself. Its own support documentation states that certain tasks related to the update continue in the background and "might affect battery life and thermal performance". Anyone who notices shorter battery life after an update should wait a few days and check again, according to Apple.

So if you think something is wrong with your iPhone after the update: it is working. If you want to be sure, charge the device overnight and then check Settings, Battery to see which items sit at the top.

Who gets the update

iOS 26.6 runs on the iPhone 11 and newer, so also on the iPhone 17 and the iPhone 17 Pro Max. iPadOS 26.6 covers the iPad Pro 12.9-inch from the 3rd generation, the iPad Pro 11-inch from the 1st generation, the iPad Air from the 3rd generation, the iPad from the 8th generation and the iPad mini from the 5th generation. You install it under Settings, General, Software Update. Apple has released macOS Tahoe 26.6, watchOS 26.6, tvOS 26.6, visionOS 26.6 and Safari 26.6 alongside it.

87 holes with no known attack does not make waiting harmless. With the release the technical descriptions are public, and the effort for attackers drops sharply.