AI Agent Crafts macOS Remote‑Root Exploit in Four Hours, Attackers Already Mining

Key Points

• Calif used an AI agent to create exploits for two macOS remote‑root bugs in four hours.
• CVE‑2026‑65400 is already being abused to install Monero miners on compromised Macs.
• Apple released patches on August 6 for macOS 26.6.1, 15.7.9 and 14.8.9.
• Dutch NCSC confirmed active exploitation; every case involved root access and crypto mining.
• Approximately 40,000 macOS devices expose port 5900 to the internet, half located in the U.S.
• Severity scores differ: Dutch NCSC rates the bug 7.1, CISA rates it 9.8.
• Immediate mitigation: install the update or disable Screen Sharing and block port 5900.
• The incident highlights AI’s role in accelerating the move from vulnerability discovery to exploitation.