Apple Private Cloud Compute Flaw Enables Root File Writes and AI Inference Telemetry Leakage

Cybersecuritynews •Abinaya • August 10, 2026

CVE-2026-20685 is a path traversal vulnerability affecting Apple’s Private Cloud Compute (PCC), potentially allowing attackers to write files as root during node boot and redirect sensitive AI inference telemetry to an external server. Sentry Security researcher Drinor received a $150,000 Apple Security Bounty for discovering and reporting CVE-2026-20685, a flaw that could expose sensitive data […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Apple's Private Cloud Compute Vulnerability Exposes Sensitive Data A path traversal vulnerability (CVE-2026-20685) in Apple's Private Cloud Compute (PCC) was discovered by security researcher Drinor Selmanaj, leading to a $150,000 bounty. The flaw allows attackers in a privileged network position to write files as root during node boot and redirect AI inference telemetry to an external server. Although sensitive data such as prompt and answer text did not leak, telemetry information including token counts and latency data was exposed, which could aid in fingerprinting users. The vulnerability was reported through Apple's Virtual Research Environment, which is designed for security testing. Apple has since addressed the issue in PCC Release 5E290.3 and later. This incident highlights the importance of security in AI-driven environments, especially those handling sensitive user data. 4 sources 71

Extracted Entities

Apple Private Cloud Compute Flaw Enables Root File Writes and AI Inference Telemetry Leakage

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (2)