Cases › security breach › LR-2026-0494
Apple Intelligence guardrails bypassed with prompt injection
Preliminary Why: Publisher not yet named · subject to change
Status: no action reported
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity minor: Test: minor (contained to one evaluation). Fact: the attack was run as an evaluation by researchers; no third party harm is stated.
Researchers tested Apple's on-device language model, which receives prompts via an API call and passes them through input and output safety filters. They chained two techniques: they wrote a harmful string backwards and used a Unicode right-to-left override character so it displayed normally while remaining reversed in the raw input and output the filters inspected, then embedded it in a Neural Exec prompt-override attack. Together these let the attack get past the filters and make the model ignore its safety directives. In their tests the attackers reached a 76% success rate over 100 random prompts. They disclosed the issue to Apple in October 2025. Apple has since hardened its safeguards against this attack, with protections rolled out in iOS 26.4 and macOS 26.4. The issue is now corrected.
What happened
What was done
No source states an action or fix.
Risks
Primary50 incidents
Rising: 6 vs 2.8 a week
Also84 incidents
Rising: 6 vs 3.8 a week
Read from the sources; not yet reviewed by a person.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
HarnessOutside content treated as data, not instructions · Prompt-injection detection · Confirmation after untrusted input · Validation of tool inputs and outputs · Tool allow-list
ApplicationHuman approval for high-impact actions · Least-privilege access for the agent · Segmentation of agent components · Alerts on unusual tool use
Similar incidents
Evidence
- What set it off hidden instructions in its input
No source states: what the AI was doing, what went wrong, what it reached or did, when it happened, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what was done.
Show the full account: 1 items from the primary sources
What happened, in order
- 2025-10 Researchers disclosed the attack to Apple.
Show every field, with its source and grade
What happened
Impact
LR-2026-0494 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON