Too Private to Tell: Practical Token Theft Attacks on Apple Intelligence

• URL: http://arxiv.org/abs/2604.15637v1
• Date: Fri, 17 Apr 2026 02:32:29 GMT
• Title: Too Private to Tell: Practical Token Theft Attacks on Apple Intelligence
• Abstract summary: Apple Intelligence is a generative AI (GenAI) service provided by Apple on its devices.<n>We present our investigation into this token issuance mechanism with a goal to reveal possible vulnerabilities.<n>Specifically, we present the first practical cross-device token replay attack against Apple Intelligence.
• Score: 9.964425648424017
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Apple Intelligence is a generative AI (GenAI) service provided by Apple on its devices. While offering a similar set of features as other similar GenAI services, Apple Intelligence is claimed to be designed with an extra focus on user security and privacy through a two-stage authentication and authorization design using anonymous access tokens. In this paper, we present our investigation into this token issuance mechanism with a goal to reveal possible vulnerabilities using traffic analysis, reverse engineering, and cross comparison with Apple's public documentation. Specifically, we present the Serpent attack, the first practical cross-device token replay attack against Apple Intelligence that allows the attacker to steal the access tokens from the victim's device and utilise them on a different device, with all usage rate-limited against the victim. We have achieved successful attacks on the latest macOS 26 Tahoe and demonstrated that an attacker, who even has used up its own allowance, can immediately regain access to Apple Intelligence service. We have responsibly disclosed the vulnerabilities to the vendors and received confirmation from Apple with CVE assigned and bounty given. Our results highlight a general lesson for built-in AI services: Anonymising identity does not by itself make the AI service secure; Enforcing non-transferability requires cryptographic binding to the rightful user.

Related papers

• Stealth and Evasion in Rogue AP Attacks: An Analysis of Modern Detection and Bypass Techniques [0.0]
  This project aimed to design a stealth-capable Rogue AP and evaluate its detectability against Suricata, an open-source NIDS/IPS.<n>Using Wifipumpkin3, the research team successfully deployed a captive portal that harvested user credentials from connected devices.<n>This paper details the construction of the attack, the evasion techniques employed, and the limitations of current NIDS solutions in detecting localized wireless threats.
  arXiv  Detail & Related papers  (2025-12-11T09:45:48Z)
• Cuckoo Attack: Stealthy and Persistent Attacks Against AI-IDE [64.47951172662745]
  Cuckoo Attack is a novel attack that achieves stealthy and persistent command execution by embedding malicious payloads into configuration files.<n>We formalize our attack paradigm into two stages, including initial infection and persistence.<n>We contribute seven actionable checkpoints for vendors to evaluate their product security.
  arXiv  Detail & Related papers  (2025-09-19T04:10:52Z)
• WatchWitch: Interoperability, Privacy, and Autonomy for the Apple Watch [50.89778047875175]
  We reverse-engineer the Apple Watch's wireless protocols.<n>With WatchWitch, we break out of Apple's walled garden.<n>We thus pave the way for more consumer choice in the smartwatch ecosystem.
  arXiv  Detail & Related papers  (2025-07-09T18:33:58Z)
• Not All Prompts Are Secure: A Switchable Backdoor Attack Against Pre-trained Vision Transformers [51.0477382050976]
  An extra prompt token, called the switch token in this work, can turn the backdoor mode on, converting a benign model into a backdoored one. To attack a pre-trained model, our proposed attack, named SWARM, learns a trigger and prompt tokens including a switch token. Experiments on diverse visual recognition tasks confirm the success of our switchable backdoor attack, achieving 95%+ attack success rate.
  arXiv  Detail & Related papers  (2024-05-17T08:19:48Z)
• Attacks on Deidentification's Defenses [0.4974890682815778]
  We present three new attacks on Quasi-identifier-based deidentification techniques. First, we introduce a new class of privacy attacks called downcoding attacks. Second, we convert the downcoding attacks into powerful predicate singling-out attacks. Third, we use LinkedIn.com to reidentify 3 students in a $k$-anonymized dataset published by EdX.
  arXiv  Detail & Related papers  (2022-02-27T22:50:36Z)
• AirGuard -- Protecting Android Users From Stalking Attacks By Apple Find My Devices [78.08346367878578]
  We reverse engineer Apple's tracking protection in iOS and discuss its features regarding stalking detection. We design "AirGuard" and release it as an Android app to protect against abuse by Apple tracking devices.
  arXiv  Detail & Related papers  (2022-02-23T22:31:28Z)
• A Master Key Backdoor for Universal Impersonation Attack against DNN-based Face Verification [33.415612094924654]
  We introduce a new attack against face verification systems based on Deep Neural Networks (DNN) The attack relies on the introduction into the network of a hidden backdoor, whose activation at test time induces a verification error allowing the attacker to impersonate any user. We present a practical implementation of the attack targeting a Siamese-DNN face verification system, and show its effectiveness when the system is trained on VGGFace2 dataset and tested on LFW and YTF datasets.
  arXiv  Detail & Related papers  (2021-05-01T13:51:33Z)
• Backdoor Attack against Speaker Verification [86.43395230456339]
  We show that it is possible to inject the hidden backdoor for infecting speaker verification models by poisoning the training data. We also demonstrate that existing backdoor attacks cannot be directly adopted in attacking speaker verification.
  arXiv  Detail & Related papers  (2020-10-22T11:10:08Z)
• Mind the GAP: Security & Privacy Risks of Contact Tracing Apps [75.7995398006171]
  Google and Apple have jointly provided an API for exposure notification in order to implement decentralized contract tracing apps using Bluetooth Low Energy. We demonstrate that in real-world scenarios the GAP design is vulnerable to (i) profiling and possibly de-anonymizing persons, and (ii) relay-based wormhole attacks that basically can generate fake contacts.
  arXiv  Detail & Related papers  (2020-06-10T16:05:05Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.