Loading story…
Apple said some Apple Intelligence requests that exceed on-device limits will now run in Google Cloud under an expanded Private Cloud Compute (PCC) architecture, while simpler tasks continue to be processed locally and other cloud workloads remain on Apple-operated servers. The company said its newer model stack includes on-device AFM 3 Core and AFM 3 Core Advanced, Apple-hosted AFM 3 Cloud and ADM 3 Cloud, and AFM 3 Cloud Pro, which runs on Google-owned NVIDIA hardware for more demanding queries.
Apple said the privacy model is unchanged despite the move to third-party infrastructure, with protections built around stateless processing, non-targetability, no privileged runtime access, and verifiable transparency. To enforce those guarantees on Google Cloud, Apple said it is using NVIDIA Confidential Computing, Intel TDX, Google’s Titan security chip, Apple-signed software attestation, and a cryptographically verifiable append-only ledger of approved hardware; the company also plans to publish PCC binaries and extend researcher access through the Apple Security Bounty program.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Apple said it plans to publish Private Cloud Compute binaries and provide research access through the Apple Security Bounty program. This was presented as part of the transparency and verification measures for PCC running in third-party environments.
Apple said it is extending Private Cloud Compute to third-party Google Cloud data centers for Apple Intelligence workloads that exceed on-device limits. Apple stated that the privacy and security model remains the same and relies on confidential computing, hardware attestation, and a cryptographically verifiable append-only ledger for approved Google Cloud hardware.
Apple described a hybrid Apple Intelligence design in which simpler requests are handled on-device and more advanced tasks are sent to cloud models, including models running on Apple-operated servers and Google-owned hardware. The company said supported devices use AFM 3 Core, while higher-end hardware uses AFM 3 Core Advanced for features such as improved dictation and a more expressive Siri voice.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has introduced Private AI Compute, a privacy-enhancing technology designed to process AI queries securely in the cloud while maintaining on-device-level privacy guarantees. The system leverages Trillium TPUs and Titanium Intelligence Enclaves, utilizing AMD-based Trusted Execution Environments (TEEs) to encrypt and isolate memory, ensuring that user data remains inaccessible to Google and protected from physical exfiltration attacks. The infrastructure supports mutual attestation and encrypted communication between trusted nodes, with strict controls to prevent unauthorized access and ensure that only validated workloads are executed. To assess the security of this new platform, Google engaged NCC Group for a comprehensive review, including architectural analysis and detailed cryptographic assessments of key components such as the Oak Session Library, attestation mechanisms, and the T-Log system. The review also covered configuration and source code analysis to evaluate the robustness of the system's privacy and security controls. This independent evaluation highlights Google's efforts to provide strong privacy assurances for cloud-based AI processing, addressing concerns about data confidentiality and integrity in modern cloud environments.
Jun 29, 2026
Apple fixed **CVE-2026-20685**, a path traversal flaw in its Private Cloud Compute (PCC) environment that could allow an attacker to write files as root during node boot and redirect sensitive AI inference telemetry to an external server. The vulnerability was found in `darwin-init`, a root-privileged early boot component that extracted attacker-controlled archives without properly blocking traversal sequences, enabling writes outside the intended directory and onto PCC's writable data volume. Apple rated the issue as information disclosure with a CVSS score of **6.5** and addressed it in PCC releases **5E290.3 and later**. Research showed a crafted archive could persist across boot and modify PCC logging behavior through `splunkloggingd` configuration, exposing metadata tied to Apple Intelligence inference requests inside Apple's Virtual Research Environment. The work, published through Sentry's AI security research effort, also highlighted an attestation gap because files on the writable data volume that could influence runtime daemon behavior were not included in PCC attestation measurements. Sentry researcher **Drinor** reported the flaw and received a **$150,000** Apple Security Bounty.
Aug 11, 2026
Google DeepMind has piloted a double-blind evaluation framework for its proprietary **Gemini 2.5 Flash Lite** model, designed to prevent benchmark leakage and contamination. External evaluators can submit confidential prompts, benchmarks, and scoring code without exposing them to Google, while Google keeps model weights and inference code confidential; the pilot is intended to validate the testing method rather than publish model-performance scores. The project involves the Singapore AI Safety Institute, OpenMined, AVERI, and MLCommons, using private benchmarks within a cryptographically protected environment. Its architecture combines Google Cloud Confidential Space, an NVIDIA H100 Confidential GPU, Intel TDX-encrypted host memory, remote attestation, and OpenMined PySyft controls. The safeguards go beyond contractual confidentiality and zero-logging practices, but the model still requires trust in Google-operated attestation and signing systems, the cloud platform, and underlying hardware vendors.
Aug 27, 2026