--- title: Release Notes framework: Private Cloud Compute Security Guide role: article role_heading: Article path: private-cloud-compute/releasenotes --- # Release Notes Apple publishes new features, resolved issues, and known issues for each PCC software release. ## Overview Overview PCC server software releases are described by their build numbers, which you can find in the output of pccvre release list. Known issues listed here are not eligible for Apple Security Bounty. PCC Release 6BX5284r Stateless Inference Known Issues On PCC on Google Cloud, disaggregated serving and cross-node KV cache transport are present in the software image but are not enabled or used in production. PCC Releases 6A375, 6AX1661 PCC on Google Cloud New Features This is the first PCC on Google Cloud release in production, serving requests at the launch of the 27.0 operating systems. Apple doesn’t publish Google Cloud node images from earlier releases. Hardware Integrity Known Issues PCC Certificate ceremony process in the PCC transparency log. Verification of a certificate’s inclusion in the log is not yet enforced: a user’s device, a PCC proxy node, and an ensemble leader each validate the DCA CA signature on a node’s certificate, but don’t yet enforce the presence of transparency inclusion proofs. (167793384) Google Cloud Node Hardening Known Issues The Script-execution policy recognizes Python interpreters by process name, which limits its coverage in two ways (187893777): eBPF programs match process names derived from caller-supplied paths without verifying file identities, so a caller can alter its invocation path to avoid policy enforcement. lsecuritymonitorlited enumerates interpreter names once, from the file systems it can see itself, so it doesn’t recognize a Python binary that exists only in a component’s own file system. PCC VRE Resolved Issues Fixed: pccvre now parses PCC on Google Cloud attestations in Apple Intelligence Reports and Google Cloud releases in the PCC transparency log. The Understand attestation, the transparency log, and releases cover a node’s Intel TDX, NVIDIA, and Titan-rooted evidence in the attestation and transparency-log verify-inclusion commands, and typed Google Cloud release entries in the release commands. PCC Release 6A536500 PCC Agent New Features Safety overrides now apply to model output as well as model input. Based on the rule set, PCC Agent either matches each token once it’s emitted, keeping tokens flowing, or holds tokens in a bounded window and matches before emitting them, which is designed to keep matched content from reaching the device. (171929974, 171929930) PCC VRE Known Issues pccvre release download may reuse a previously downloaded asset from a different Google Cloud Node Architecture release. These releases publish assets under generic filenames such as image.tar.gz, and pccvre caches downloads by filename, so a later release can pick up the earlier release’s file. This can cause pccvre release verify to report a mismatch or pccvre instance create to boot the wrong OS image. Workaround: Pass --overwrite to pccvre release download when switching between PCC on Google Cloud releases to force a fresh download of every asset. (184553308) Resolved Issues Fixed: HomeKit Secure Video Analysis is now functional in the VRE. You can Exercise HomeKit Secure Video Analysis using shadowed inference nodes. (162980713) Fixed: Embedding Generation is now functional in the VRE, exercised as part of the HomeKit Secure Video Analysis workflow. (175893613) Fixed: External tool calls are now functional in the VRE. You can Exercise external tool calling using a mock tool gateway. (178925540) Fixed: Recitation prevention and Private Filter Service are now functional in the VRE. You can Exercise recitation prevention using a PFS instance and simulate a block. (175181163) Fixed: Safety overrides are now functional in the VRE. You can Exercise safety overrides by generating a custom override asset, delivering it through cloud asset distribution, and issuing a request that matches one of your patterns. (175190354) Known Issues pccvre instance invoke tool cloudboard-vre-cli fails with dyld: Library not loaded: /System/Library/PrivateFrameworks/LocalCloudBoardClient.framework. To work around this, rerun the command with --debug, find the cloudboard-vre-cli path, and re-sign that binary in place with empty entitlements (codesign -f -s - --entitlements empty.plist ""). (183686140) Shadow Tunneling fails because ShadowTunnelCloudApp and ShadowTunnelCloudController fail to launch with not allowed for Restricted Execution Mode state. To work around this, copy both binaries from a running instance into a staging directory (scp root@:'/private/var/PrivateCloudSupport/usr/libexec/ShadowTunnelCloud*' ), and package that directory with pccvre cryptex create -S -V ShadowREM, which marks every binary it packages as permitted before and after REM. Add the result with pccvre instance configure cryptex add. (183685895) A VRE instance restored from a “PCC Agent Worker LLASSI” release fails to boot. To work around this, either remove the NATURAL_VOICES_SE_CV13 cryptex before you start the instance, or, on macOS 27.0 or later, create the instance with pccvre instance create --disk-size 200. (182844655) PCC Release 6A535100 PCC Agent Resolved Issues Fixed: A secure-configuration value that selects whether a delegation-eligible tool runs in an isolated Delegated tool calls or locally on the PCC Agent is now attested. Previously, this value was read without attestation, so modifying it could cause a tool intended for an isolated workload to instead run on the agent and weaken the security isolation between use cases. (178863006) PCC VRE Known Issues pccvre instance create fails for 6A releases with Error: The operation couldn't be completed. Bad file descriptor. To work around this, run pccvre release download with the --debug option, find the release metadata file in the output, edit it to remove the identifier and cacheable properties from all cryptex objects, then run pccvre instance create. (182410431) New Features You can now use the VRE to Run a multi-turn interaction across two instances, facilitating security research of Multi-Turn Agent workflows. (178925610) You can now Exercise cloud asset distribution in the VRE, using the control-plane testing server and pccvre http-server to deliver test assets to cloudassetdownloaderd. (181776480) Resolved Issues Fixed: Encrypted thinking traces now function in the VRE. The agent automatically includes the appropriate configuration to produce them, so no manual setup is required. (178398307) PCC Release 6A533200 PCC VRE Resolved Issues Fixed: You can now download the assets that contain models used by Embedding Generation and Speech Synthesis by using the VRE tooling as part of the 6A533200h.5 build for these workloads. (181774667, 181732651) PCC Release 6A531700 Recitation Prevention Resolved Issues Fixed: The attestations of the server nodes used for Private Filter Service were not included in the Apple Intelligence Report. (176864434) Fixed: Some blocked requests related to Recitation prevention were incorrectly treated as recitation infrastructure blocks, so the number of recitation prevention blocks could be logged and made accessible to Apple. (178401486) PCC Releases 6A5272, 6AX5221 These releases serve only requests from users on the 27.0 Beta operating systems. PCC release 6A5272q was a non-production release that we used solely for early internal testing with the 27.0 Beta operating systems. This release never took customer traffic, and the release notes below may not describe all issues present in release 6A5272q. PCC on Google Cloud Preview Known Issues Some PCC requests from 27.0 Beta operating systems are served by PCC on Google Cloud. During the preview period, PCC on Google Cloud is gradually ramping toward the complete set of security, privacy, and transparency properties of Private Cloud Compute. We are working with security researchers and red teams to assess PCC on Google Cloud, and will launch a public security research program later this year. Request Flow New Features Starting in iOS and macOS 27, PCC consolidates token issuance into the Client authentication, which vends One-Time Tokens to clients directly. PCC accounts for the varying cost of inference requests when applying a user’s rate limit, using a privacy-preserving Cost feedback. Known Issues The keys that sign Cost feedback are not yet published to the Release Transparency. Researchers can use the transparency log to verify that only one set of OHTTP and OTT keys is in use in a given time period, but can’t yet do the same for cost-token signing keys. (181951488) Transitive Trust New Features PCC proxy nodes establish Transitive Trust using a single transparency proof anchored to a Trusted log revisions, rather than carrying a trusted release set. Stateless Inference New Features TIE pre-computes a Static prefix cache over Apple-supplied prompt prefixes, avoiding redundant KV cache computation across requests. For multi-turn interactions, TIE can KV cache reuse produced by a previous turn, using per-turn keys supplied by the user’s device. PCC can return encrypted intermediate model reasoning to the device as Encrypted thinking traces. PCC Agent New Features PCC Agent can issue External tool calls to tools hosted outside the PCC trust boundary through a dedicated tool gateway. This release adds several PCC Agent workflows, including Multi-Turn Agent. Known Issues A secure-configuration value that is read without attestation determines whether a delegation-eligible tool runs in an isolated Delegated tool calls or locally on the PCC Agent. Modifying that configuration could cause a tool intended to run in an isolated workload to instead run on the agent, weakening the security isolation between use cases. (178863006) Visual Generation New Features Visual Generation is a new application that runs the Apple Diffusion Model on PCC to generate images for on-device features such as Image Playground and Photos editing, implemented as a new PCC Agent workflow. Each request runs a staged flow in which content-safety guardrails screen the prompt and input images before the diffusion model runs, and screen the generated image afterward. For requests with large images, these stages are Inference orchestration. Recitation Prevention Known Issues Some blocked requests related to Recitation prevention are incorrectly treated as recitation infrastructure blocks, so the number of recitation prevention blocks may be logged and made accessible to Apple. (178401486) The attestations of the server nodes used for Private Filter Service are not included in the Apple Intelligence Report. (176864434) PCC VRE Known Issues Some new features are not functional in the Virtual Research Environment, including: Recitation prevention and Private Filter Service (175181163) Safety overrides (175190354) Encrypted thinking traces (178398307) Embedding Generation (175893613) External tool calls (178925540) Visual Generation (169196354) HomeKit Secure Video Analysis (162980713) The Workout Buddy workflow (FitnessIntelligenceAgent) and its Speech Synthesis capability (175698349) The assets that contain models used by Embedding Generation and Speech Synthesis are not yet downloadable using the VRE tooling due to a publishing issue. (181774667, 181732651) pccvre does not yet parse PCC on Google Cloud attestations in Apple Intelligence Reports or releases in the PCC transparency log. We’ll add support when the public security research program launches. In the meantime, pccvre release list on macOS 27.0 Beta notifies users about unparsable releases. macOS 26.4, iOS 26.4, and iPadOS 26.4 Apple Intelligence Report Starting with macOS 26.4, iOS 26.4, and iPadOS 26.4, attestation bundles in the Base64-encoded attestation bundles are Base64-encoded Protobuf instead of JSON. PCC VRE pccvre attestation subcommands now accept Apple Intelligence Reports Inspect an attestation bundle and support parsing Base64-encoded Protobuf attestations. PCC Release 5E290.3 Visual Lookup New Features Visual Lookup is a new application supported in this PCC release, leveraging Private Information Retrieval and a new PCC Agent workflow. Known Issues The Visual Lookup feature is not functional in the Virtual Research Environment. (162320010) PCC VRE New Features Shadow Tunneling makes it easier to exercise Transitive Trust flows and PCC Agent workflows. darwin-init Resolved Issues Impact: An attacker in a privileged network position may be able to leak sensitive information. Description: A path handling issue was addressed with improved validation. CVE-2026-20685: Drinor Selmanaj (Sentry) and Suresh Sundaram PCC Release 5C235 Prefill-decode disaggregation New Features PCC nodes can split processing of a request across two different ensembles using Prefill-decode disaggregation. PCC Release 5A5264.1 PCC VRE Resolved Issues TIE Proxy can now Restrict proxy transitive trust, facilitating security research of Transitive Trust. (148253942) Known Issues pccvre fails to restore TIE Proxy releases and returns the error, “TIE Proxy VRE requires macOS Tahoe 26”. Workaround: Use macOS Tahoe 26 and add the --skip-release-requirements-check argument to pccvre instance create. (157755443) PCC Release 5A5214b.2 Transitive Trust New Features PCC now uses PCC proxy nodes, based on the concept of Transitive Trust, to establish the encrypted communications between the user’s device and the PCC nodes that perform the user’s request. The PCC proxy node simultaneously increases performance of request distribution while providing the ability to significantly reduce the number of PCC nodes that are able to decrypt any given user’s request, which improves the system’s resilience against sophisticated supply-chain attacks. This architecture helps meet the same performance goals while allowing the PCC Gateway to instruct users’ devices to Node selection, allowing the system to operate with a maximum value of k well below the value required by the previous approach. The PCC Security Guide reflects this new flow, though client software prior to iOS 18.5 and macOS 15.5 continues to use the previous approach of encrypting directly to k nodes. (136167375) PCC VRE Known Issues PCC can route requests using Transitive Trust through TIE Proxy. TIE Proxy is not supported in the VRE in this build. (148253942) TIE accepts images as input to perform Language model inference. The VRE demo model doesn’t currently support this feature. (147590493)