Published
- 4 min read
By Allan D - Editor, AI Security Wire
Apple Pays $150K for Path Traversal Bug in Private Cloud Compute
Apple’s Private Cloud Compute was built on a specific promise: your device can hand off a heavy AI Intelligence task to Apple’s servers, and the server will not be able to see or keep what you sent it. Stateless, attested, no persistent storage that could leak back to Apple or anyone watching. It is one of the more carefully engineered privacy architectures a major AI vendor has attempted.
Turns out the promise had a crack in it, and it came from a bug class old enough to buy a house.
A Path Traversal Bug in the Boot Sequence
Drinor Selmanaj, founder and CTO of security firm Sentry, went looking at darwin-init, the very first userspace process that runs as root when a PCC node boots up, before any of the steady-state security services are active. Its job includes unpacking archive files to set up the node. The function that extracts those archives appended entry pathnames straight into an output directory without checking whether those names tried to climb back out of it with ../ sequences.
That is a textbook path traversal flaw, the same bug class behind Zip Slip and CVE-2007-4559, both close to two decades old at this point. Selmanaj crafted a tar archive that mixed traversal sequences with a structurally valid Apple cryptex bundle, so it would pass the system’s normal validation checks while quietly writing files somewhere it should not have been able to reach: /var/db/, a location meant for persistent storage on a system that is supposed to be stateless by design.
From File Write to Telemetry Redirect
A root-level file write during boot is bad on its own, but Selmanaj pushed further to show real impact. He targeted the configuration file for splunkloggingd, the daemon that forwards operational telemetry off the node, and pointed it at a server he controlled instead of Apple’s own collection endpoint.
What came through was per-request inference metadata: request identifiers, device-grouping information, model and workload identity, plus input and output token counts and latency figures. None of it was prompt text or model output, that data is handled through a separate path that strips out before telemetry leaves the node, and Selmanaj confirmed it stayed inaccessible. But metadata about who is running what workload, how often, and how big, is exactly the kind of operational fingerprint PCC’s “sealed observability” guarantee exists to prevent from escaping.
There is a second wrinkle that matters more than the leak itself. The configuration files controlling daemon behavior on a PCC node were not covered by PCC’s attestation chain, the cryptographic mechanism that is supposed to let anyone verify a node is running exactly the software Apple published and nothing else. A node with a poisoned config could still pass attestation and look legitimate from the outside, since attestation checked the software running, not every file steering how it behaved.
Fixed Quietly, Paid Generously
All of this ran inside Apple’s Virtual Research Environment, the official sandbox Apple ships specifically so researchers can probe PCC without touching real hardware or real user traffic. Selmanaj reported the chain through Apple’s standard disclosure process. Apple assigned CVE-2026-20685, rated it CVSS 6.5 as an information disclosure issue, and shipped a fix in PCC release 5E290.3.
The $150,000 payout lands in the top tier of Apple’s PCC bounty structure, a program with five reward bands running from $50,000 up to $1,000,000 for the most severe classes of compromise, and it reflects that this was genuine access across a trust boundary Apple has spent years publicly defending as unbreakable, not a cosmetic finding.
Why This One Is Worth Watching
PCC is the closest thing the industry has to a public reference architecture for confidential AI inference, and Apple has invited scrutiny of it deliberately, publishing source components and standing up the VRE specifically so researchers would try to break it. That transparency is working as intended here: a real flaw got found, reported, and fixed through the front door instead of surfacing later as an active exploit.
It is also a reminder that stateless, attested infrastructure is only as strong as its least-scrutinized subsystem. Everyone was watching the attestation chain and the inference pipeline. Nobody had stress-tested the boot-time archive extractor, and that is where a thirty-year-old bug class found room to operate. Any team building confidential compute or trusted execution environments for AI inference should take note: audit the boot sequence and the logging and telemetry stack with the same rigor applied to the model-serving path, because attackers, and apparently researchers, will look there too.
References
Frequently Asked Questions
- What is CVE-2026-20685?
- It is a path traversal vulnerability in darwin-init, the first userspace process that runs as root when an Apple Private Cloud Compute node boots. Because the archive extraction routine did not sanitize file pathnames inside tar archives, an attacker could write files outside the intended directory and reach persistent storage on the node. Apple rated it CVSS 6.5 and classified it as information disclosure.
- What data could an attacker actually see?
- By overwriting the configuration file for PCC's telemetry forwarder, the researcher redirected a stream of inference metadata to a server he controlled: request IDs, device-grouping identifiers, model and workload identity, and token and latency counts. Apple's telemetry pipeline is designed to strip prompt text and model output before it ever leaves the node, and the researcher confirmed that content stayed out of reach. What leaked was metadata about requests, not their contents.
- Was this exploited against real Apple Intelligence users?
- No. The researcher, Drinor Selmanaj of Sentry, did all testing inside Apple's Virtual Research Environment, the sanctioned sandbox Apple provides specifically for PCC security research. No production PCC nodes or real user data were touched. Apple fixed the issue in PCC release 5E290.3 and paid a $150,000 bounty before any public disclosure.