{"schema_version":"0.10.0","id":"LR-2026-0494","record_version":1,"title":"Apple Intelligence guardrails bypassed with prompt injection","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":43.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.2,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"6de7519399d07019d215cdb57e6d93d0272c5e917df436c1b8c50ef17511957b"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-04-09","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"prompt_injection","duration":null,"detection_method":"public_researcher","summary":"Researchers tested Apple's on-device language model, which receives prompts via an API call and passes them through input and output safety filters. They chained two techniques: they wrote a harmful string backwards and used a Unicode right-to-left override character so it displayed normally while remaining reversed in the raw input and output the filters inspected, then embedded it in a Neural Exec prompt-override attack. Together these let the attack get past the filters and make the model ignore its safety directives. In their tests the attackers reached a 76% success rate over 100 random prompts. They disclosed the issue to Apple in October 2025. Apple has since hardened its safeguards against this attack, with protections rolled out in iOS 26.4 and macOS 26.4. The issue is now corrected.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK01","secondary_risks":["RK12"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"Test: minor (contained to one evaluation). Fact: the attack was run as an evaluation by researchers; no third party harm is stated.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://9to5mac.com/2026/04/09/researchers-detail-how-a-prompt-injection-attack-bypassed-apple-intelligence-protections/","publisher":"9to5Mac","date":"2026-04-09","type":"press","title":"Apple Intelligence protections bypassed with prompt injection - 9to5Mac","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"event.incident_class":"C","event.trigger":"C","event.detection_method":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"Two blog posts (1, 2) published today on the RSAC blog (via AppleInsider) detail how researchers combined two attack strategies to get Apple’s on-device model to execute attacker-controlled instructions through prompt injection."}],"event.trigger":[{"source_index":0,"quote":"Two blog posts (1, 2) published today on the RSAC blog (via AppleInsider) detail how researchers combined two attack strategies to get Apple’s on-device model to execute attacker-controlled instructions through prompt injection."}],"event.detection_method":[{"source_index":0,"quote":"Two blog posts (1, 2) published today on the RSAC blog (via AppleInsider) detail how researchers combined two attack strategies to get Apple’s on-device model to execute attacker-controlled instructions through prompt injection."}],"impact.severity":[{"source_index":0,"quote":"During evaluation, we randomly sample one element from each pool, assemble a full prompt, create an armed payload (see below), inject it, and test whether the attack succeeds by invoking the Apple on-device model through the OS."}],"impact.severity_because":[{"source_index":0,"quote":"During evaluation, we randomly sample one element from each pool, assemble a full prompt, create an armed payload (see below), inject it, and test whether the attack succeeds by invoking the Apple on-device model through the OS."}],"event.summary":[{"source_index":0,"quote":"A now corrected issue allowed researchers to circumvent Apple’s restrictions and force the on-device LLM to execute attacker-controlled actions."},{"source_index":0,"quote":"With that in mind, the researchers found they could chain two exploit techniques to make Apple’s model ignore its basic safety directives while simultaneously tricking the input and output filters into letting the harmful content through."},{"source_index":0,"quote":"In their tests, the attackers reached a 76% success rate over 100 random prompts."},{"source_index":0,"quote":"They disclosed the attack to Apple in October 2025, and the company “has since hardened the affected systems against this attack, and those protections were rolled out in iOS 26.4 and macOS 26.4.”"},{"source_index":0,"quote":"Apple has since hardened its safeguards against this attack"}]},"notes_on_gaps":"Single press source (9to5Mac) relaying researchers' RSAC blog posts; the researchers' own posts were not provided. The source does not name the model or its version, the exact date the incident occurred or was detected, the harness, or the countries involved, so those are omitted. The source does not say which control Apple added; mapping the hardening to C2 (prompt-injection detection) is my judgement and is not stated. The source does not say whether an autonomous agent was involved, so no failure_class is set. The responsible party and remediation are based on Apple's statement that it hardened its systems. The severity tier minor is my judgement: the test was an evaluation by researchers and no third-party harm or count is stated. Reversibility is omitted as not stated. The 'now corrected' wording is a press statement and is not a verified date of fix. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"caught","text":"The researchers disclosed the attack to Apple in October 2025.","quote":"They disclosed the attack to Apple in October 2025, and the company “has since hardened the affected systems against this attack, and those protections were rolled out in iOS 26.4 and macOS 26.4.”","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://9to5mac.com/2026/04/09/researchers-detail-how-a-prompt-injection-attack-bypassed-apple-intelligence-protections/"]},"analysis":{"sections":{"timeline":[{"text":"Researchers disclosed the attack to Apple.","quote":"They disclosed the attack to Apple in October 2025, and the company “has since hardened the affected systems against this attack, and those protections were rolled out in iOS 26.4 and macOS 26.4.”","source_index":0,"when":"2025-10"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://9to5mac.com/2026/04/09/researchers-detail-how-a-prompt-injection-attack-bypassed-apple-intelligence-protections/"]}}