Apple Private Cloud Compute Vulnerability Allows Root File Writes and AI Telemetry Leakage
A critical path traversal vulnerability in Apple's Private Cloud Compute (PCC) system, CVE-2026-20685, discovered by Sentry Security, allows attackers to write files as root and exfiltrate AI inference telemetry.
A significant security vulnerability, identified as CVE-2026-20685, has been discovered in Apple's Private Cloud Compute (PCC) system, a crucial component of Apple Intelligence. The flaw, reported by Sentry Security researcher "drinor" who received a $150,000 Apple Security Bounty, enables attackers to write arbitrary files with root privileges during the node boot process and potentially redirect sensitive AI inference telemetry to external servers.
PCC is designed as Apple's server-side platform for handling complex Apple Intelligence requests that exceed the capabilities of local devices. Apple emphasizes that the system extends device-level privacy protections into the cloud, utilizing stateless request processing, cryptographic attestation, and tightly controlled logging. However, the vulnerability resides in darwin-init, the very first userspace process initiated on a PCC node. This process runs with root privileges and is responsible for downloading, extracting, personalizing, and installing cryptex packages before initiating a reboot into the normal operating environment.
The vulnerability stems from how darwin-init selects an archive extractor. According to Sentry Security's research, the process only examined the first four bytes of an incoming file to determine its type. A malicious tar archive, which did not match known Apple archive signatures, was consequently passed to a generic extraction function. This function appended archive entry names to the intended output path without adequately validating path traversal sequences, such as ../../../../.
This oversight allowed a crafted archive to escape its designated extraction folder and write attacker-controlled files to persistent locations on the PCC node's writable data volume. Crucially, because darwin-init executes with root privileges before steady-state security services are fully loaded, these maliciously placed files could persist even after the system rebooted. The researcher demonstrated this by creating an archive containing both traversal entries and a structurally valid cryptex bundle.
One of the critical impacts demonstrated involved PCC's internal splunkloggingd service. This service checks for a configuration file on the writable data volume to initiate its operation. By leveraging the root file write capability, an attacker could create a malicious logging configuration file, thereby redirecting PCC telemetry data to a controlled endpoint. The exfiltrated data reportedly included CloudBoard daemon activity, node events, and metadata associated with AI inference requests.
During testing within Apple's Virtual Research Environment, the logs exposed sensitive details such as application bundle identifiers, workload types, request identifiers, device-grouping metadata, token counts, output-token metrics, and latency measurements. These data points could reveal insights into how a PCC node processes AI requests, including prompt lengths and AI model performance metrics like first-token latency and speculative decoding information. Notably, some of this metadata is reportedly classified as information that should not be logged publicly by Apple.
Furthermore, the Sentry Security research uncovered an attestation gap. While Apple's PCC attestation process verifies the integrity of installed software and cryptex components, it did not extend to measuring the contents of the writable data volume that could influence daemon behavior at runtime. This means a modified node could appear identical to a clean node during software attestation checks, potentially masking a compromise.
Apple has classified CVE-2026-20685 as an information disclosure issue with a CVSS score of 6.5. The company has addressed the vulnerability by releasing patches in PCC versions 5E290.3 and later. The security research was conducted exclusively within Apple's official Virtual Research Environment, with no evidence suggesting that production PCC infrastructure was involved.