Press play to start listening
Apple has fixed a vulnerability in Private Cloud Compute that could allow an attacker in a privileged network position to write files as root during server startup. In testing, the file-write vulnerability was used to redirect Apple Intelligence inference and node telemetry.
Drinor Selmanaj, the founder and CTO of Sentry, identified the vulnerability in darwin-init, the first userspace process launched when a Private Cloud Compute node boots. Apple assigned it CVE-2026-20685 and awarded Selmanaj a $150,000 bug bounty.
Private Cloud Compute handles Apple Intelligence requests that are too complex for an iPhone, iPad, or Mac to process locally. Apple built the system to discard user data after processing, limit which records can leave a server, and use cryptographic attestation to verify the software running on each node.
When a node starts, darwin-init downloads and installs signed packages called cryptexes. Selmanaj found that its generic archive extractor failed to validate file paths stored inside an archive properly. This allowed a malicious tar file containing directory traversal sequences to write files outside the intended extraction folder.
The archive was supposed to unpack inside /var/tmp/darwin-init/cryptex/<UUID>/. In a file path, ../ tells the system to move up one directory. Selmanaj placed ../../../../db/ before the archive filenames, climbing four directories back to /var/ before entering /var/db/. Files stored there survived the userspace reboot.
There was still a barrier to producing a working exploit. An invalid cryptex would fail installation and stop the server from completing its startup process. Selmanaj placed the traversal entries inside an archive that also contained a valid cryptex created with Apple’s research tools. The package passed the installation checks while depositing attacker-controlled files in /var/db/.
When the node restarted, a planted configuration file caused splunkloggingd, Apple’s internal log-forwarding service, to send records to Selmanaj’s server. The modified service sent about 785 KB of system events and node telemetry to a server controlled by Selmanaj. More records arrived while the node continued operating.
Selmanaj then submitted AI inference requests through the test node. The redirected records contained request identifiers, workload information, model identity, token counts, and timing measurements. Complete prompts were not exposed, though the information could reveal usage patterns and assist with side-channel analysis.
His tests also found that Private Cloud Compute’s attestation checks did not detect the modified configuration on the writable data volume. Apple’s verification tool could not distinguish the modified node from a clean one. It measured installed software and cryptex contents but did not check the configuration files written to the data volume.
Selmanaj performed all testing inside Apple’s Virtual Research Environment and did not target production infrastructure. According to Apple, exploiting the vulnerability on a live server would require an attacker to hold a privileged position on the network.
Apple classified CVE-2026-20685 as an information-disclosure vulnerability with a CVSS score of 6.5. The company corrected the path-handling error through improved validation in Private Cloud Compute release 5E290.3 and later versions. Sentry published Selmanaj’s findings on July 31, 2026.
