Too Private to Tell: Practical Token Theft Attacks on Apple Intelligence
This work reveals a critical security flaw in Apple's token-based authentication for its generative AI service, highlighting that anonymization alone is insufficient for security in built-in AI services.
The paper presents the Serpent attack, a cross-device token replay attack against Apple Intelligence that allows an attacker to steal access tokens from a victim's device and use them on another device, bypassing usage rate limits. The attack was successfully demonstrated on macOS 26 Tahoe, and the vulnerabilities were disclosed to Apple, resulting in a CVE assignment and bounty.
Apple Intelligence is a generative AI (GenAI) service provided by Apple on its devices. While offering a similar set of features as other similar GenAI services, Apple Intelligence is claimed to be designed with an extra focus on user security and privacy through a two-stage authentication and authorization design using anonymous access tokens. In this paper, we present our investigation into this token issuance mechanism with a goal to reveal possible vulnerabilities using traffic analysis, reverse engineering, and cross comparison with Apple's public documentation. Specifically, we present the Serpent attack, the first practical cross-device token replay attack against Apple Intelligence that allows the attacker to steal the access tokens from the victim's device and utilise them on a different device, with all usage rate-limited against the victim. We have achieved successful attacks on the latest macOS 26 Tahoe and demonstrated that an attacker, who even has used up its own allowance, can immediately regain access to Apple Intelligence service. We have responsibly disclosed the vulnerabilities to the vendors and received confirmation from Apple with CVE assigned and bounty given. Our results highlight a general lesson for built-in AI services: Anonymising identity does not by itself make the AI service secure; Enforcing non-transferability requires cryptographic binding to the rightful user.