AI
How Apple Intelligence Routes Data
Apple Intelligence splits processing between two model groups. On-device models handle text and image tasks locally with no network calls. For heavier requests, the system routes to Private Cloud Compute: servers Apple claims no employee can access and where data is never stored. Three server categories also operate for Siri: gazuni.apple.com for dictation, a search services endpoint for lookups, and extension servers for third-party integrations like ChatGPT. Apple’s stated policy is to send only relevant data to any of these endpoints.
Breaking Through Certificate Pinning
Apple protects Siri traffic with SSL, certificate pinning, and System Integrity Protection (SIP), which blocks process hooking. Apple publishes steps to disable SIP, so Magid disabled it and used Frida to hook set_verify_mode in Apple’s modified BoringSSL fork. That bypassed pinning, but the dictation server ran a custom HTTP stack with an undocumented ACE method and a mismatched content-length header that crashed standard proxies. Magid patched mitmproxy’s source to read the stream until it closed. The full tool, including the mitmproxy extension for macOS Sequoia, is published on GitHub.
What a Simple Weather Query Leaks
Asking Siri for Las Vegas weather triggered three categories of unexpected data being sent to Apple servers. GPS coordinates go to the search services endpoint on every Siri query, including arithmetic (“what is 1+1”). Siri also performs topic modeling and scans the device for all installed apps matching the topic. For a weather question, it found a weather app running inside a Parallels Windows virtual machine. The dictation server receives a separate request listing all currently open apps on the device.
Audio Metadata and Messaging Content Reach Apple Servers
The same query that asked about weather also sent Taylor Swift song data to Apple servers. A YouTube tab in the browser was playing. Siri sends full now-playing queue metadata (track name, creator, file size) to the dictation server on every interaction. This explains the Notion incident that started the research: a paused embedded video stayed in the now-playing queue, and Siri sent the document title to Apple servers. Siri also sends WhatsApp message content, contact names, and phone numbers to Apple servers even when on-device processing handles the full task without network access.
ChatGPT Calls Proxied Through Apple’s Servers
Using ChatGPT through Apple Intelligence does not connect your device directly to OpenAI. Traffic goes through Apple’s extension servers, which are separate from Private Cloud Compute. This applies to both personal and organizational accounts. A second request also travels to the search services endpoint on the same query, with no documentation on who at Apple has access. Magid disclosed both behaviors to Apple. Apple confirmed the proxy behavior is intentional and offered to clarify documentation stating ChatGPT traffic does not use Private Cloud Compute.
Apple’s Response and Mitigations
Magid reported all findings to Apple in February. A month later, Apple said they would fix the issues. Four weeks before this talk, they changed position: the problems were labeled Siri issues, not Apple Intelligence issues, and Magid was directed to contact Notion and WhatsApp. He built a test SiriKit app following Apple’s own documentation exactly and reproduced the same data leak, ruling out third-party misconfiguration. Apple has since passed the messaging issue to engineering. Two immediate mitigations help: block gazuni.apple.com at the network level, and disable all “improve Siri and dictation” settings Apple enables by default.
Q&A
Was iMessage affected by the same SiriKit data leak? Yes, Siri dictation for iMessage also routes through Apple servers, and Magid filed it as part of the disclosure. ▶ 37:42
Notable Quotes
They send our location every time we ask Yoav Magid · ▶ 18:34
the now playing queue to their servers. Yoav Magid · ▶ 22:18
it’s not necessary to operate. Yoav Magid · ▶ 24:47
Siri. That’s not Apple Intelligence. Yoav Magid · ▶ 36:15
Key Takeaways
- Siri sends GPS coordinates to Apple servers on every query, including simple arithmetic questions.
- Apple’s custom HTTP stack blocks standard proxies; inspecting Siri traffic required patching mitmproxy source.
- WhatsApp messages sent through Siri transmit message content and contact details to Apple servers unnecessarily.
- Block gazuni.apple.com and disable default “learn from experience” settings to reduce data exposure.
About the Speaker(s)
Yoav Magid is a security researcher at Lumia Security focused on AI security, social engineering, and embedded operating systems. He holds a B.Sc. in Computer Science and brings over seven years of cybersecurity experience in embedded research and high-stakes environments. He is preparing to pursue an MBA and founded a large-scale LGBTQIA+ Employee Resource Group at his previous organization.