Apple Private Cloud Compute Flaw Let a Researcher Write Files as Root. Here’s Why It Matters.
Apple fixed a path traversal flaw in Private Cloud Compute, the cloud system behind demanding Apple Intelligence requests, after a researcher showed it could write attacker-controlled files as root during a PCC node boot.
The interesting part isn’t just the root-level write: the exploit also exposed a gap between what PCC attestation verifies and what can still shape a node after startup.
➜ The real story: Apple built Private Cloud Compute around the idea that its AI cloud can be independently verified, and this bug is a very public reminder that verification only works when researchers keep pushing on the edges.
Tracked as CVE-2026-20685, the flaw was found by security researcher Drinor Selmanaj of Sentry.
Apple rated it as an information disclosure vulnerability with a CVSS score of 6.5, fixed it in PCC Release 5E290.3 and later, and awarded Selmanaj $150,000 through the Apple Security Bounty program.
How CVE-2026-20685 Broke Apple Private Cloud Compute at Boot
The vulnerable piece was darwin-init, the first userspace process that runs when a PCC node boots.
It runs as root and handles configuration plus the extraction and installation of cryptographically sealed system bundles called cryptexes.
Selmanaj found that one generic archive-extraction path accepted file names without properly normalizing or validating where they would land, so a crafted archive could climb out of its intended folder and write into persistent locations such as /var/db.
Because those files survived the userspace reboot, the result was more than a throwaway boot-time glitch.
Why the Apple Intelligence Private Cloud Compute Flaw Matters
The proof of concept went a step further by dropping a configuration file for PCC telemetry and redirecting selected logs to a server controlled by the researcher.
That stream exposed request-related metadata such as token counts, timing, workload identifiers and request IDs, although the published work did not show prompt text being stolen.
Selmanaj also found that the poisoned and clean research nodes looked the same across the attestation fields he could inspect, suggesting that writable configuration state was outside parts of the verification chain.
That’s the uncomfortable bit, but also the useful one: Apple deliberately opened PCC to independent research, and the system produced exactly the kind of expensive bug report that can make the privacy architecture stronger.
FAQs
What is CVE-2026-20685?
CVE-2026-20685 is a path traversal vulnerability in Apple Private Cloud Compute that allowed a privileged network attacker to make root-level file writes during node boot.
Was Apple Intelligence user data stolen through CVE-2026-20685?
No production compromise was reported in the disclosed research. The proof of concept ran in Apple Virtual Research Environment and demonstrated exposure of telemetry and request metadata rather than prompt text.
Has Apple fixed the Private Cloud Compute vulnerability?
Yes. Apple addressed the path handling flaw with improved validation in Private Cloud Compute Release 5E290.3 and later.
