BEYOND PROMPT INJECTION: HACKING APPLE'S PRIVATE CLOUD COMPUTE

Summary from the TLDR InfoSec newsletter

Researcher Drinor Selmanaj discovered a path traversal vulnerability (CVE-2026-20685) in darwin-init that allowed attackers to write persistent files to the writable data volume on Apple's Private Cloud Compute nodes. By hijacking the splunkloggingd process, the exploit successfully redirected node telemetry to an attacker-controlled server, exposing sensitive job metadata and inference token counts. Apple's attestation chain only measures installed software and ignores writable-volume states, so this persistent tampering went entirely undetected, ultimately earning the researcher a $150,000 bounty and prompting a patch in PCC release 5E290.3.