AI
How Apple Intelligence Routes Data Between Device and Cloud
Apple Intelligence runs on three separate infrastructures, and which one handles your request determines where your data goes. On-device models run locally on macOS and iOS with no network calls. When the task is too complex for those, a routing model on your device decides whether to send data to Private Cloud Compute. Siri adds two more servers: gazuni.apple.com for dictation and smooth.apple.com for search. A request to Siri for the weather and a request through Apple Intelligence to ChatGPT travel different paths, hit different servers, and fall under different privacy policies — from the same app, with no visible indicator of which route fired.
Bypassing Siri’s Certificate Pinning to See the Traffic
Seeing what Apple Intelligence sends to its private cloud compute was straightforward. Apple logs every request on the device itself. Siri was a different problem. On top of TLS, Siri adds certificate pinning, which validates that the remote endpoint is an Apple server and refuses any other connection. A standard proxy sees nothing. Magid spent months bypassing that pinning on his own device, then had to reverse-engineer Apple’s proprietary protocol layer on top of it. That work was the prerequisite for every finding that follows.
What a Simple Weather Query Leaks to Apple Servers
Magid typed one prompt — “what is the weather today in Las Vegas?” — then watched the intercepted packet (11:46). The first field: precise GPS coordinates. The next: the Weather app, followed by Parallels, a virtual machine manager. Siri had scanned every app on the device, matched them by topic, and shipped the list to Apple’s search services — including apps running inside VMs.
“For every request you’re doing with Siri, your location is being sent by default. Even if you ask a math question, how much is one plus one?” — Yoav Magid
That wasn’t all. A second packet, sent to the dictation server, contained all active running apps: Slack, Finder, Notion. Then a third finding (16:03): metadata for a Taylor Swift track from an open YouTube tab. Any media added to the now-playing queue goes to both servers — including audio embedded in a paused Notion document, title and all.
Siri Messaging Integration Sends Message Content to Apple’s Dictation Server
Asking Siri to send a WhatsApp message does more than open WhatsApp. The message content, the contact’s name, and the phone number travel to Apple’s dictation server at gazuni.apple.com before the message goes anywhere. Magid blocked all Apple server communication entirely and asked Siri to send the message again (18:56) — the recipient still got it. The dictation-server packet is not part of the send flow. The same behavior appeared with iMessage. To rule out a WhatsApp implementation bug, Magid built a fresh app from Apple’s own SiriKit documentation (28:06) and got the identical result. Email and calendar integrations did not leak content, only messaging services did.
ChatGPT Prompts Are Routed Through Apple Servers, Not Directly to OpenAI
Apple’s ChatGPT extension is the only third-party model available through Apple Intelligence, and every prompt goes through Apple’s own servers before reaching OpenAI. That alone surprised Magid. What he found watching the traffic (23:00) was worse: each ChatGPT query hit two endpoints. One was the Apple Intelligence extensions infrastructure, as expected. The other was the search services endpoint he had already seen vacuuming up app lists and location data. The search services response never reaches the user. Magid could not explain why the prompt was sent there at all, or who has access to that data.
Mitigations and the Transparency Gap in AI-Era Privacy
Two mitigations reduce exposure now. Block the dictation server endpoint (gazuni.apple.com) — Siri messaging still works without it, so nothing breaks. Then audit which apps Apple is allowed to learn from in Siri settings.
The harder problem is structural. Certificate pinning took Magid months to bypass. Enterprise monitoring tools hit the same wall.
“Pinning is a very good mechanism in many features like when you are upgrading software for example but when you’re interacting with AI you’re uploading data that should not be an obstacle — not to researchers like me who just want to know what am I uploading or to organizations who want to monitor their network.” — Yoav Magid
Ask Siri “what’s the weather” and you’re under Siri’s privacy policy. Rephrase it as “weather vibes” and ChatGPT activates under different terms (30:08). Same app. Average users cannot tell which one fired.
Q&A
Did you use Apple’s virtual Private Cloud Compute research environment, and is certificate pinning still a challenge there? He did not use the virtual PCC environment — all research ran on macOS with Siri in the standard setup, using a custom script to break certificate pinning that he is publishing in a blog post. ▶ 37:31
Does the data Siri sends to Apple’s servers for WhatsApp messages carry the same end-to-end encryption that WhatsApp guarantees? No definitive answer — he confirmed the data travels over TLS with certificate pinning but said he has no visibility into what Apple does with it server-side, only that sending it is unnecessary because blocking the endpoint does not break the feature. ▶ 38:24
Notable Quotes
There is no model in the world that can know what is the weather today without invoking any API some tool. Yoav Magid · ▶ 11:22
For every request you’re doing with Siri, your location is being sent by default. Even if you ask a math question, how much is oneplus 1? Yoav Magid · ▶ 12:38
I just know it leaves my device and it’s not needed to do that. Yoav Magid · ▶ 39:26
Pinning is a very good mechanism in many features like when you are upgrading software for example but when you’re interacting with AI you’re uploading data that should not be an obstacles not to researchers like me who just want to know what am I uploading or to organizations who want to monitor their network. Yoav Magid · ▶ 34:19
Can you tell the difference between them? Yoav Magid · ▶ 36:58
Key Takeaways
- Audit every app in Siri settings and block the dictation server endpoint to cut unnecessary data exposure today.
- Assume Siri sends location, running apps, and media metadata with every prompt — not just the words you type.
- Certificate pinning on consumer AI products makes enterprise data governance impossible without active bypass techniques.