Apple unveiled four opt-in Audio Intelligence capabilities for Apple Watch Series 12 and Apple Watch Ultra 4: Siri Recap, which creates notes from detected conversations; Live Rewind, which displays a transcription of the preceding 15 seconds of speech; automatic Shazam music recognition; and Sound Recognition alerts. The features are expected to enter English-language beta later in 2026, require an Apple Intelligence-capable iPhone, and will initially be unavailable in the European Union.
Apple said the watches do not create or retain conventional audio recordings. Sensor-derived audio is isolated in the S11 chip’s Secure Enclave and is inaccessible to the operating system, apps, users, and Apple; raw audio is deleted after processing. Most processing occurs locally, while tasks requiring cloud resources use Private Cloud Compute: for Siri Recap, encrypted conversation audio is transferred to the paired iPhone for local transcription and minimization, then deleted before encrypted distilled text is sent for cloud processing.

Track how attackers are adapting to this technology.
7 events from the most recent confirmed update back to the earliest known activity.
Apple described Music Recognition's use of a non-reversible acoustic signature sent to Shazam, and said Live Rewind is activated by a Digital Crown double-press to show speech from the preceding 15 seconds. It also detailed Siri Recap's encrypted processing path from the watch Secure Exclave through the paired iPhone to Private Cloud Compute.
Apple announced opt-in Audio Intelligence features for Apple Watch Series 12 and Apple Watch Ultra 4, including Siri Recap, Live Rewind, Shazam-based music recognition, and Sound Recognition. Apple said raw audio is isolated for processing and not retained as conventional recordings.
Apple said Siri Recap processes surrounding audio in the Secure Enclave without recording or storing it, then sends an encrypted condensed text representation to Private Cloud Compute for final summaries. Apple also described content filtering, opt-in scheduling and toggles, seven-day deletion of unsaved summaries, and end-to-end encryption for summaries saved through iCloud.
Apple said Live Rewind activation triggers a full-screen animation, microphone indicator, and audible chime that plays even in silent mode or when headphones are connected. Apple also said processing occurs in the S11 Secure Exclave without generating retained audio recordings, and unsaved transcript snippets are deleted about 30 seconds after the display dims.
The Electronic Frontier Foundation criticized Apple Watch Series 12's Live Rewind and Siri Recap features, arguing that people near the watch have no practical way to consent to or decline processing of their conversations. The group warned that transcription or summarization without clear opt-in consent could undermine conversational privacy and encourage self-censorship.
Apple's Xcode 27 developer tool indicates that Apple Watch Series 12 and Apple Watch Ultra 4 have 4GB of RAM, double the 2GB in the prior Series 11 and Ultra 3. The watches retain U.S. starting prices of $399 and $799, respectively.
Apple introduced redesigned optical and electrical heart sensors and a Health Sensing System for the Apple Watch Series 12 and Ultra 4. The watches add a Readiness score and an updated pedometer model intended to improve indoor distance and daily step-count accuracy.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
9 references tracked. Mallory keeps watching after this page renders.
macrumors.com
Open sourcemacrumors.com
Open sourcetheregister.com
Open sourcereddit.com
Open sourcemacrumors.com
Open sourcetidbits.com
Open sourcesupport.apple.com
Open sourcemacrumors.com
Open sourcewired.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.