Researchers bypass Apple Intelligence safeguards with prompt injection attack
Researchers demonstrated a prompt injection attack that successfully bypassed Apple Intelligence's safety filters by combining Unicode character manipulation and instruction override techniques. Apple patched the vulnerability in iOS 26.4 and macOS 26.4 after the researchers reported it in October 2025.
What happened
Researchers combined two attack techniques to bypass Apple Intelligence's safety protections. They wrote harmful strings backward and applied a Unicode RIGHT-TO-LEFT OVERRIDE character to make the text render correctly on screen while remaining reversed in the raw input and output where filters inspect it.
The researchers embedded the backwards harmful string within a technique called Neural Exec, which overrides the model's core instructions with attacker-controlled directives. This approach worked in 76 percent of test cases, allowing the on-device model to ignore its basic safety rules and execute unauthorized commands.
Reported impact
The attack successfully tricked both the input and output filters built into Apple Intelligence while causing the on-device model to misbehave and execute attacker-controlled actions.
Index analysis
The researchers exploited the gap between how Apple's input and output filters process text (by inspecting raw reversed text) versus how the model itself processes and renders instructions. By making harmful content invisible to the filters while remaining legible to the model's instruction processing, they forced the system to bypass its safety directives.
Governance controls
Researchers reported the vulnerability to Apple in October 2025. Apple hardened its safeguards and released software updates to block the attack in iOS 26.4 and macOS 26.4.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.