Apple Private Cloud Compute

What it is

Private Cloud Compute (PCC) is Apple's server system for Apple Intelligence features that need larger foundation models than a device can run ¹. Apple built it on custom servers with Apple silicon, the Secure Enclave and Secure Boot ¹. Apple states that security researchers must be able to verify that PCC's privacy and security guarantees match its public promises ¹.

PCC applies TEE remote attestation to show users which software handles their AI requests. It was designed to keep those requests private, and its checks concern software releases.

In June 2026 Apple announced that it was extending PCC to Google Cloud systems with NVIDIA GPUs, using NVIDIA confidential computing, Intel CPUs with TDX and Google's Titan chip ³. Apple stated that this deployment would reach its complete set of protections gradually during a summer preview period ³.

How it works

Apple describes the chain as follows ¹:

1. Every piece of code a node can run must be in a trust cache signed by Apple and loaded by the Secure Enclave, so it cannot change at runtime. Code and model assets use the integrity protection of Apple's Signed System Volume.
2. Apple publishes the measurements of all code running on PCC in an append-only transparency log, and the corresponding software images within 90 days.
3. A user's device encrypts each request only to the keys of nodes whose attested measurements match a release in the log.

For research, Apple publishes a Virtual Research Environment that boots PCC releases in a virtual machine on an Apple silicon Mac, checks the transparency log and runs inference against demonstration models ². Apple also publishes source code for its attestation and request-handling components under a limited-use licence, and offers bounties of up to $1,000,000 for PCC findings ².

Apple's threat model includes an attacker with physical access to a node who can subvert some hardware protections ¹. Apple's answer is that an attacker should not be able to target particular users without compromising the whole system. It relies on a hardened hardware supply chain, including imaging each server's components before sealing it, and on routing that does not let an attacker steer chosen users' requests to a compromised node ¹. On Google Cloud, Apple reports that attestation is rooted in at least two separate roots of trust from independent vendors, with attested keys held in a separate confidential virtual machine ³.

Evidence

• Researchers at the Hasso Plattner Institute, TU Darmstadt and IMDEA Networks reverse-engineered PCC's client and sent custom queries to the production service between December 2025 and March 2026 ⁴. They found that one-time request tokens could be reused, that a signature check was skipped and that token salts let requests be linked. Apple clarified its documentation but did not change the checks ⁴. The study, peer-reviewed at WiSec 2026, concerns request privacy, not attestation.
• An independent researcher working in Apple's research environment found a path-traversal flaw that let a node's configuration be altered while its attestation stayed unchanged (CVE-2026-20685) ^{5 6}. Apple fixed it and paid a $150,000 bounty ⁵.
• Apple reports that for the Google Cloud deployment it will publish all binaries and give researchers access to live nodes in research mode ³.

Limitations

• The published checks concern software releases. Apple reports that model assets share the code's integrity protection ¹, and its research environment runs demonstration models ².
• PCC ships compiled binaries without reproducible builds or symbols, which its independent analysts say leaves room for differences between the specification and what is shipped ⁴.
• Attestation measured installed software but not writable configuration files in the one published attack ⁵.
• Only Apple's own client software sends requests to PCC. There is no API for third parties ⁴.
• The Google Cloud deployment runs on Intel TDX and NVIDIA confidential computing ³. Independent researchers have forged TDX attestations with physical access and relayed H100 attestations to a workload outside TEE protection ⁷.