{"id":390701,"date":"2026-04-09T23:38:13","date_gmt":"2026-04-09T23:38:13","guid":{"rendered":"https:\/\/www.newsbeep.com\/ie\/390701\/"},"modified":"2026-04-09T23:38:13","modified_gmt":"2026-04-09T23:38:13","slug":"apple-intelligence-protections-bypassed-with-prompt-injection","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/ie\/390701\/","title":{"rendered":"Apple Intelligence protections bypassed with prompt injection"},"content":{"rendered":"

\t\"It's<\/p>\n

A now corrected issue allowed researchers to circumvent Apple\u2019s restrictions and force the on-device LLM to execute attacker-controlled actions. Here\u2019s how they did it.<\/p>\n

Apple has since hardened its safeguards against this attack<\/p>\n

Two blog posts (1<\/a>, 2<\/a>) published today on the RSAC blog (via AppleInsider<\/a>) detail how researchers combined two attack strategies to get Apple\u2019s on-device model to execute attacker-controlled instructions through prompt injection.<\/p>\n

Interestingly, they successfully executed the exploit without being 100% sure of how Apple\u2019s local model handles part of the input and output filtering pipeline, since Apple doesn\u2019t disclose the exact details of the inner workings of its models, likely for security reasons.<\/p>\n

Still, the researchers note that they have a pretty good idea of what goes on under the hood.<\/p>\n

According to them, the most likely scenario is that after a user sends a prompt to Apple\u2019s on-device model via an API call, an input filter ensures the request doesn\u2019t contain unsafe content.<\/p>\n

If that is the case, the API fails. Otherwise, the request is forwarded to the actual on-device model, which in turn hands over its response to an output filter that checks whether the output contains unsafe content, either causing the API to fail or letting it through, depending on what it finds.<\/p>\n

\"\"Image: Rotten Apples: The Technical Details of RSAC\u2019s Successful Apple Intelligence Prompt Injection Attack<\/a><\/p>\n

How they actually did it<\/p>\n

With that in mind, the researchers found they could chain two exploit techniques to make Apple\u2019s model ignore its basic safety directives while simultaneously tricking the input and output filters into letting the harmful content through.<\/p>\n

First, they wrote the harmful string backwards, then used the Unicode RIGHT-TO-LEFT OVERRIDE character to make it render correctly on the user\u2019s screen, while keeping it reversed in the raw input and output where the filters would inspect it.<\/p>\n

The researchers then embedded the backwards harmful string within a second attack method called Neural Exec, which is basically an elaborate way to override the model\u2019s instructions with whatever new instruction an attacker might want to execute.<\/p>\n

\"\"Image: Is That a Bad Apple in Your Pocket? We Used Prompt Injection to Hijack Apple Intelligence<\/a><\/p>\n

As a result, the Unicode attack managed to bypass the input and output filters, while the Neural Exec managed to actually cause Apple\u2019s model to misbehave.<\/p>\n

To evaluate the effectiveness of the attack, we prepare three distinct pools to create suitable input prompts:<\/p>\n

System prompts: A collection of system prompts\/tasks (e.g., \u201cEdit the provided text to align with American English spelling and punctuation conventions\u201d).<\/p>\n

Harmful strings: Manually crafted strings designed to be considered offensive or harmful (i.e., the outputs we aim to force the model to generate).<\/p>\n

Honest inputs: Paragraphs sourced from random Wikipedia articles, used to simulate non-adversarial, benign-looking inputs (e.g., in the context of indirect prompt injection via RAG or similar systems).<\/p>\n

During evaluation, we randomly sample one element from each pool, assemble a full prompt, create an armed payload (see below), inject it, and test whether the attack succeeds by invoking the Apple on-device model through the OS.<\/p>\n

In their tests, the attackers reached a 76% success rate over 100 random prompts.<\/p>\n

They disclosed the attack to Apple in October 2025, and the company \u201chas since hardened the affected systems against this attack, and those protections were rolled out in iOS 26.4 and macOS 26.4.\u201d<\/p>\n

To read the report in full, which also includes a link to the technical aspects of the attack, follow this link<\/a>.<\/p>\n

Worth checking out on Amazon<\/p>\n

\t\t
\n\t\t\t\"Add
\n\t\t\t\"Add
\n\t\t<\/a><\/p>\n

FTC: We use income earning auto affiliate links. More.<\/a><\/p>\n

\"\"<\/a>\t\t\t\t<\/p>\n","protected":false},"excerpt":{"rendered":"A now corrected issue allowed researchers to circumvent Apple\u2019s restrictions and force the on-device LLM to execute attacker-controlled…\n","protected":false},"author":2,"featured_media":5212,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[61,60,80],"class_list":{"0":"post-390701","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-technology","8":"tag-ie","9":"tag-ireland","10":"tag-technology"},"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/390701","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/comments?post=390701"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/390701\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media\/5212"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media?parent=390701"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/categories?post=390701"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/tags?post=390701"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}