Apple Patches PCC Flaw That Risked AI Inference Data Leaks

Apple’s Private Cloud Compute, or PCC, handles some Apple Intelligence requests that require more processing power than a user’s device can provide. The system is designed to extend AI capabilities while limiting exposure of personal information. A vulnerability in PCC’s darwin-init component was therefore significant because it touched the security architecture underpinning Apple’s privacy commitments for cloud-based AI inference.

Apple patched the path traversal vulnerability, tracked as CVE-2026-20685, in PCC version 5E290.3. If exploited, the flaw could have redirected system telemetry and metadata associated with AI inference to an external server. Apple said it had found no evidence that production systems were compromised. The company did not disclose a financial impact or specify the exact date when the update was deployed.