AIDEFEND in Action AIA-0013 Validated Research Published: Apr 25, 2026

Apple Intelligence Hijack: Prompt Injection Against an OS-Level Local LLM

RSAC researchers combined a Neural Exec adversarial input with Unicode right-to-left override to bypass Apple Intelligence's local LLM filters and internal guardrails. Apple Intelligence is Apple's OS-level AI feature set, so the broader lesson is that a local LLM needs input canonicalization, output validation, per-app capability scoping, and client-side isolation before app data and functions become model-accessible. Apple has since shipped hardened iOS and macOS releases, with no reported in-the-wild exploitation.

Prompt InjectionGuardrail BypassInput ValidationOn-Device AIApple Intelligence
8 applicable AIDEFEND defenses
Source: Is That a Bad Apple in Your Pocket? We Used Prompt Injection to Hijack Apple Intelligence 
Authors: Petros Efstathopoulos, PhD, Laura Koetzle, Dario Pasquini, PhD
Original article: Apr 9, 2026

Threat Analysis

  • The attack targets an OS-managed local model. Apple Intelligence exposes an on-device LLM through Foundation Models, so third-party apps can use a system-level model without controlling weights or runtime.
  • The bypass combined model steering and filter evasion. RSAC researchers used Neural Exec-style adversarial input to push the model toward an attacker-chosen task, then used Unicode RLO to hide offensive text from input and output filters.
  • The measured success rate was material. The researchers say it succeeded on 76% of 100 random prompts before Apple's hardening.
  • The practical risk comes from app context. A compromised LLM-enabled app could expose or manipulate data and functions already available to that app.
  • The fix landed at the platform layer. Apple hardened the affected systems in iOS 26.4 and macOS 26.4; users should upgrade, and app teams should still reduce what local model calls can see and do.
RLO rendering example showing the underlying string invoice_2026_[U+202E]fdp.exe and the visually misleading result that appears more like invoice_2026_exe.pdf
Example: hidden U+202E changes display order. The string still contains .exe, but can appear as .pdf.

Applicable AIDEFEND Defenses (8)

AID-H-002.002
Inference-Time Prompt & Input Validation
High
At the app-controlled inference ingress, G002 can reject RLO and other forbidden format characters under a versioned field contract before prompt assembly. Preserve permitted multilingual and code semantics; the optional lossy detection view must never replace model input. The exact admitted bytes and policy must bind the detector and model. This constrains the disclosed RLO carrier; it does not guarantee recognition of Neural Exec or every semantic redirection, and app code cannot repair the platform model.
AID-H-018.004
Intent-Based Dynamic Capability Scoping
High
At an operator-controlled tool dispatcher, intersect authenticated subject, workload, registry and separately authorized task grants; enforce signed scope, expiry and atomic action budgets, including the G002 trusted-registry and external-audit wrapper. Untrusted content may narrow scope but cannot grant tools. This denies out-of-scope calls, not misuse of an already permitted tool or malicious answers within the allowed task. Every alternate execution path needs verified coverage; provider-managed runtime enforcement is not established by this mapping.
AID-H-003.010
Deployed AI Software Vulnerability Remediation Lifecycle
High
Treat the affected Apple Intelligence device population as an AI-software remediation case: stage the hardened OS release, retain rollback readiness and verify the effective OS build on each affected endpoint. RSAC identifies platform hardening, not a separate Neural Engine vulnerability. Fleet patch completion remains distinct from testing the prompt and output gates.
AID-I-007
Client-Side AI Execution Isolation
High
Because the model runs on the client device, containment matters even when the model is OS-managed. Per-app sandboxing, controlled IPC, entitlement checks, and isolation from unrelated app or OS state keep a coerced local model from becoming a cross-app data or action path.
AID-M-009.002
Authority Envelope & Action Risk Classification
High
Classify manipulation of app-accessible health data, media files, and other user content as high-risk actions rather than ordinary text generation. The authority envelope records which actions require confirmation, denial, or a narrower data view; runtime capability and data-use gates consume those facts and enforce the result.
AID-H-006.002
Text, Markup & Structured Output Sanitization and Release Gate
Medium
Enforce a sink-specific release gate before displaying model output or passing it to app logic. HTML escaping alone preserves RLO and does not make misleading display order safe. A Unicode-aware approval/display adapter must visibly escape or reject disallowed controls under the sink policy and be independently tested; the published G001 HTML/process-argument wrapper does not implement it. Action authorization remains separate.
AID-D-001.001
Per-Prompt Content, Intent & Obfuscation Analysis
Medium
At an operator-controlled ingress, G001 can apply a pinned, calibrated secondary classifier to the exact text passed through the app-controlled inference adapter and emit a content-bound finding for task redirection, authority claims or privilege escalation. RLO/rendered-view comparison needs a separately implemented Unicode/display adapter; G001 does not provide it. A finding supplies evidence; a separate admission policy owns refusal. Plausible or concealed instructions can evade classification. Independently validate the complete classifier result and required category coverage before admission. The current G001 sample returns PASS/NO_FINDING for empty output, missing categories or NaN scores; treat those conditions as errors and refuse admission. This validation is an additional integration guard, not behavior already supplied by the published sample.
AID-H-029.002
Lifecycle-Stage Authorization Gate
Medium
Before app data enters inference context, resolve its exact version and authoritative stage/purpose tags; deny absent, withdrawn or expired grants. This is separate from app entitlements and caller/object access checks, which G001 does not implement. It neither establishes that the platform currently provides this gate nor prevents misuse of data already authorized for the same stage and purpose.

What Defenders Should Do Now

  • Upgrade managed Apple devices to iOS 26.4 and macOS 26.4 or later, and flag older versions as exposed to the pre-hardening behavior described by RSAC.
  • Inventory apps that use Apple Intelligence or the Foundation Models framework, then classify what data each app can pass into local LLM calls.
  • Normalize and inspect model inputs before inference. Treat bidirectional Unicode controls, hidden directionality, nested encodings, and adversarial gibberish as high-risk signals that should fail closed or require additional review.
  • Validate outputs after rendering-normalization, not only as raw strings. Block responses that become unsafe after Unicode rendering or that attempt to drive app actions outside the user's original intent.
  • Limit local model calls to the minimum app capabilities needed for the task. Sensitive data and mutating actions should require explicit user or policy approval before being exposed to model context or model-directed workflows.

1 additional consideration

Endpoint-level permission transparency for local LLM apps

Beyond the agent and skill permission controls mapped above, teams should also make local LLM activity visible at the OS and endpoint-management layer: which apps reach the on-device model, which local services they contact, which data paths they read or write, which API keys or tokens they can touch, and which app actions model output can influence.
Recommendation: Expose an AI entitlement manifest in app review, MDM, privacy settings, and endpoint inventory; let admins block local LLM access to high-sensitivity data classes; and require apps to declare whether model output can modify files, health records, media, messages, or other user content.

Conclusion

This case is a useful warning about on-device AI becoming a platform security boundary. Local execution reduces some cloud exposure, but it also puts the model close to app data, user files, and OS-mediated functions. AIDEFEND  maps well to input canonicalization, output validation, capability scoping, client-side isolation, and data-use gates; the operational goal is to make a compromised local LLM boringly constrained, not broadly useful to the attacker.

Last updated: