AI agent built working exploits for macOS Screen Sharing bugs in four hours

Security firm Calif says it used an AI agent to build working exploits for two pre-authentication root bugs in macOS — and it took just four hours. One of those bugs is CVE-2026-65400, the Screen Sharing authentication flaw that attackers are already exploiting in the wild.

The vulnerability lets an attacker on the network authenticate to macOS's built-in remote desktop service without valid credentials. Apple describes it as an authentication issue that improved state management resolves. Turning on Screen Sharing opens port 5900 in the macOS firewall, which is precisely how affected machines ended up exposed.

The Dutch national cyber security centre revised its advisory on 12 August after receiving a report of active abuse. In every confirmed case, the affected system had port 5900 reachable from the internet, root had been accessed, and a Monero crypto miner had been placed on the machine.

Monero is the default coin for this kind of attack for two reasons: its transactions obscure the sender, recipient and amount, and its mining suits ordinary CPUs, which makes a hijacked laptop worth something. TechRadar expects the attackers ran XMRig, the most common Monero miner, though nobody has confirmed that.

The four-hour exploit is the part that matters most. Calif reverse-engineered Apple's out-of-band update because the update itself was a signal that something was critical. From there, an AI agent produced working exploits for two separate pre-auth remote root bugs within four hours. The firm is withholding technical details of CVE-2026-65400 until most Macs carry the patch, because producing the exploit was too easy.

Cryptomining is the visible damage, but as Ars Technica noted, it may be the least of it. Nothing stops an attacker holding root from installing something that steals credentials instead.

The pattern keeps repeating. Microsoft credited AI with finding a record crop of flaws in July, AI-discovered vulnerabilities have moved into real exploitation, and in recent weeks the same dynamic hit WordPress and Zoom's annotation features. Now it is Apple.

Severity scoring is messy: the Dutch agency rates CVE-2026-65400 at 7.1 under CVSS version 3, while CISA puts it at 9.8, critical, and NIST has not yet assessed it. Meanwhile a researcher using the handle osxreverser counted roughly 40,000 hosts with open screen sharing reachable from the internet, almost half of them in the United States.

Apple's fixes shipped in macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9 — installing the update closes the hole. If you cannot patch today, turn Screen Sharing off and block port 5900. The open question is whether attackers stay with mining or escalate to credential theft, which is the part most likely to change.