Critical Apple Private Cloud Compute Flaw Exposes AI Data, Enables Root Access

Key Takeaways

• A critical path traversal vulnerability (CVE-2026-20685) was discovered in Apple’s Private Cloud Compute (PCC).
• The flaw could allow attackers to gain root access and redirect sensitive AI inference telemetry.
• PCC, Apple’s cloud platform for complex Apple Intelligence requests, was affected.
• The vulnerability has been patched in PCC releases 5E290.3 and later.

A significant security flaw has been identified within Apple’s Private Cloud Compute (PCC) infrastructure, a critical component underpinning Apple Intelligence. The vulnerability, tracked as CVE-2026-20685, is a path traversal exploit that could enable unauthorized file writes with root privileges during system boot-up. This could lead to the redirection of sensitive AI inference data to external servers, posing a substantial risk to user privacy and data integrity.

Drinor, a researcher at Sentry Security, was credited with discovering and reporting CVE-2026-20685, earning a $150,000 Apple Security Bounty. The vulnerability’s potential impact includes exposure of confidential data and unauthorized system access.

Apple’s Private Cloud Compute is designed to handle complex Apple Intelligence requests that exceed the processing capabilities of individual iPhones, iPads, or Macs. The system is marketed by Apple as a cloud-based extension of the privacy protections inherent in its devices, utilizing stateless request processing, cryptographic attestation of approved software, and rigorously controlled logging mechanisms.

Deep Dive into the Vulnerability

The core of the vulnerability lies within darwin-init, the initial userspace process that launches on a PCC node. This process operates as PID 1 with root privileges and is responsible for downloading, extracting, personalizing, and installing cryptex packages before initiating a userspace reboot into the standard operating environment.

According to Sentry Security research, darwin-init‘s method for selecting an archive extractor was flawed, relying only on the first four bytes of an incoming file. When encountering a malicious tar archive that did not match recognized Apple archive signatures, the system would default to a generic extraction function. This function failed to adequately validate path traversal sequences (e.g., ../../../../) when appending archive entry names to the intended output path.

Consequently, a specially crafted archive could bypass its designated extraction directory and write attacker-controlled files to persistent locations on the PCC node’s writable data volume, such as /var/db/. Since darwin-init executes with root privileges before standard security services are fully operational, these malicious files could persist even after a userspace reboot.

The researcher developed a proof-of-concept malicious archive that combined traversal entries with a structurally valid cryptex bundle. This was crucial because an invalid cryptex installation would prevent the system from completing its boot process. By integrating a legitimate-looking bundle with malicious file paths, the archive could pass installation checks while simultaneously placing unauthorized files outside the intended extraction directory.

Impact: Data Redirection and Attestation Gaps

One significant impact demonstrated involved the PCC’s internal splunkloggingd service. This service checks for a configuration file on the writable data volume and activates if the file exists. By leveraging the root file write capability to create a malicious logging configuration, the researcher successfully redirected PCC telemetry to a controlled external endpoint.

The redirected data reportedly included activity from the CloudBoard daemon, node events, and metadata associated with AI inference requests. During testing within Apple’s Virtual Research Environment, these logs exposed sensitive values such as application bundle identifiers, workload types, request identifiers, device-grouping metadata, token counts, output-token metrics, and latency measurements.

Such details could provide substantial insights into how a PCC node processes AI requests. For instance, input token counts directly correlated with prompt length, while other values revealed first-token latency, speculative decoding information, and various model-related telemetry. Apple’s own source code reportedly flags some of this exposed metadata as information that should not be publicly logged.

Sentry Security research also found an attestation gap. While Apple’s PCC attestation process verified the installation of approved software and cryptex components, it did not measure files on the writable data volume that could influence daemon behavior at runtime. This oversight meant a compromised node could appear identical to a clean node during software attestation checks, effectively masking the presence of malicious modifications.

Apple classified CVE-2026-20685 as an information disclosure vulnerability with a CVSS score of 6.5. The company has since patched the flaw in PCC releases 5E290.3 and later. All testing was conducted exclusively within Apple’s official Virtual Research Environment, ensuring no production PCC infrastructure was affected.

What You Should Do

• Ensure all Apple Private Cloud Compute (PCC) instances are updated to version 5E290.3 or later to mitigate CVE-2026-20685.
• Regularly monitor system logs and telemetry for any unusual activity or redirection attempts.
• Implement robust integrity checks on writable data volumes to detect unauthorized file modifications.
• Review and strengthen internal logging configurations to prevent sensitive data from being exposed or redirected.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.