Abstract
Apple’s user-facing security model is strongest when a boundary is explicit: locked or unlocked, private or public, authorized or unauthorized. The trouble starts when a feature can act through another feature. Siri can retrieve from apps, Spotlight can expose indexed content, Shortcuts can bridge services, and interface state can change while those actions are in flight.
This research examined those seams. Rather than treating Siri, Spotlight, and individual apps as isolated targets, I tested the transitions between them: what context was passed, which component was expected to enforce authentication, and whether that assumption survived unusual sequences or timing.
The recurring failure: each component behaved plausibly in isolation, but the composed system trusted state or text that had crossed a boundary without being revalidated.
Selected findings
The public talk connects several Apple security credits that look different at the product layer but rhyme at the trust-boundary layer.
CVE-2024-44235
Spotlight could expose restricted content from the Lock Screen. Apple addressed the issue with improved checks.
CVE-2025-24198
An attacker with physical access could use Siri to reach sensitive user data. Apple restricted the options offered on a locked device.
CVE-2025-30468
Private Browsing tabs could be accessed without authentication through Siri. Apple corrected the state-management failure.
The scope was broader than a list of CVEs. Additional demonstrations explored assistant context, system actions, timing, and the amount of application state that could become visible through an indirect path.
The pattern beneath the bugs
1. Authentication was treated as inherited state
A caller could be locked while a downstream service behaved as if the request arrived from an already-authorized context. The authorization decision existed, but it was made at the wrong layer or at the wrong time.
2. Natural language expanded the reachable surface
An assistant is not only a voice interface. It is a dispatcher that converts text into actions across applications and services. That makes language an input to privileged routing logic—and turns every integration into a potential trust transition.
3. Product boundaries did not match security boundaries
Users see Siri, Spotlight, Safari, and apps as separate features. The system often composes them. A test plan organized only by product can miss the behavior that emerges between products.
How I approached it
- Map entry points. Enumerate the phrases, UI surfaces, extensions, actions, and app integrations capable of initiating a request.
- Trace context. Identify which component supplies content, which component displays it, and where lock state or authentication is expected to be enforced.
- Compose features. Exercise paths that cross product boundaries instead of testing each feature as a closed box.
- Mutate state and timing. Change lock state, application state, and operation order while a request is being resolved.
- Reduce the proof. Strip the sequence down until the missing check and its impact are reproducible without ambiguity.
Talk, slides, and demos
The complete public package includes the DEF CON recording, slide deck, and demonstration videos for the disclosed findings.
Watch the DEF CON 33 talk
Read the slide deck
Browse the demos and proof-of-concept repository