A bundle of security updates that were slated to be packaged with the upcoming iOS 26.6 update will be released early, in what is an unusual move in terms of Apple’s usual OS patch scheduling. The company said that it is pushing the updates early due to an immediate threat presented by AI hacking.
Apple generally does not release security updates in between iOS version updates. This practice may be changing, however, as AI hacking drives faster development of tools and quicker identification and exploitation of known vulnerabilities. The current batch of updates has already been deployed to the phones of customers, with the iOS 26.6 version update broadly not expected to go out until late July.
Historically, Apple has held security updates to be bundled with version updates to allow ample time for testing for compatibility and other potential unexpected issues. The move seems to be an acknowledgment that even the highly security-focused company will have to make substantial changes to keep up with AI hacking, however, as the disruptive threat of Mythos and comparable tools looms in the near future.
Apple has said that more of this can be expected, and that the new policy for security updates also extends to iPadOS and macOS. The company has made exceptions of this sort in the past, but they are relatively rare and were deployed only for very serious issues that presented an immediate threat to users (such as a known vulnerability being actively exploited during an observed hacking campaign).
The security updates for the current vulnerabilities was the iOS 26.5.2 release, which went out to devices on June 29. Apple says that this was a set of 25 fixes, but that it had no knowledge of any of the vulnerabilities being exploited in the wild prior to the release. Over half of the vulnerabilities addressed in this release had to do with WebKit, the rendering engine that iOS and iPadOS rely on for web content. One reportedly could have allowed an attacker to embed data harvesting tools in web content, and another allowed websites to capture whatever was presently in the user’s clipboard.
Apple did not directly tie this set of security updates to any known AI hacking taking place in the real world, but the rapid development of AI tools is clearly influencing policy decisions already.
The private testing of Claude’s Mythos has been the leading item in cybersecurity news for three months now, with breathless reports of nearly-instant vulnerability discovery threatening to upend defense and patching processes for all types and sizes of organizations. On June 9 Anthropic released a “limited” version of Mythos called Fable to the public, with a set of advanced security guardrails that the company says have been triggered by under 5% of sessions in its early use. Access to Fable was interrupted for most of June due to a US national security order, but has been restored as of June 30.
While there is little good evidence of AI hacking making waves in these first few weeks of public access, Fable is just the first step in ongoing updates to Claude’s power and capability (as well as expected similar boosts to models from Google, OpenAI and other competitors, including China-based DeepSeek and Tulongfeng). Apple said that these security updates were pushed up in anticipation of possible AI-assisted exploitation by attackers. The company did reveal that its internal OpenAI Codex Security was used to find three of the WebKit vulnerabilities, while researchers with Anthropic found another one using Claude.
John Bruggeman, vCISO at CBTS, notes that this is essentially going to be the nature of the new “arms race” in cybersecurity: “AI is accelerating vulnerability discovery, but the benefit is not limited to defenders. Once a fix is disclosed, attackers can use the same AI capabilities to analyze the change and identify the underlying weakness more quickly. That makes the time between disclosure and release far more consequential than it was even a year ago. Apple’s decision reflects that reality. Security fixes cannot always wait for the next feature release, and enterprises should not assume those updates can remain pending until the next maintenance window or approval cycle.”
“Once an update is available, organizations need a clear process for determining whether immediate action is required,” Bruggeman adds. “Security teams should know which devices are affected, communicate clearly with employees, and confirm installation across the environment, including devices that are offline or unmanaged. For security leaders, the real measure is how quickly an available fix becomes a verified deployment.”
It is also worth considering that new policies meant to counter AI hacking might dilute the product in other ways. One of the reasons Apple tends to hold security updates for version releases is that it prizes its vaunted first-party backward compatibility within its own ecosystem, as well as its very long-term support for older phones. For example, while iPhones older than the 11 can no longer get the most recent iOS versions they still get security updates pushed to them. At this point the only iPhones that have been officially declared obsolete and deprecated are the 1 through 5 models, with Apple still sending security updates to phone models that are now over 10 years old. More continual updates meant to address AI hacking could put new limits on this support, which is a substantial competitive advantage for Apple over the more ephemeral Android market in which a new phone can lose all support from the manufacturer within two years.
Apple may also have to push harder on users that tend to opt out of updating, perhaps taking more elements of the process out of end user hands entirely. iPhones currently allow users to turn off iOS version updates, and they can also toggle off the “Background Security Improvements” feature currently used to push the vital security updates that do occasionally appear in between version releases.
About
Contact
Our Advertising
Privacy Policy
Cookie Policy
Terms of Use
News, insights and resources for data protection, privacy and cyber security professionals.
About
Contact
Our Advertising
Privacy Policy
Cookie Policy
Terms of Use
Data Privacy
Data Protection
Cyber Security
Tech
Digital
Insights
News
Resources
Press Releases
Leave a Reply