Release Notes

Apple publishes new features, resolved issues, and known issues for each PCC software release.

Overview

PCC server software releases are described by their build numbers, which you can find in the output of pccvre release list. Known issues listed here are not eligible for Apple Security Bounty.

PCC Release 6BX5284r

Stateless Inference

Known Issues

  • On PCC on Google Cloud, disaggregated serving and cross-node KV cache transport are present in the software image but are not enabled or used in production.

PCC Releases 6A375, 6AX1661

PCC on Google Cloud

New Features

  • This is the first PCC on Google Cloud release in production, serving requests at the launch of the 27.0 operating systems. Apple doesn’t publish Google Cloud node images from earlier releases.

Hardware Integrity

Known Issues

  • PCC Certificate ceremony process in the PCC transparency log. Verification of a certificate’s inclusion in the log is not yet enforced: a user’s device, a PCC proxy node, and an ensemble leader each validate the DCA CA signature on a node’s certificate, but don’t yet enforce the presence of transparency inclusion proofs. (167793384)

Google Cloud Node Hardening

Known Issues

  • The Script-execution policy recognizes Python interpreters by process name, which limits its coverage in two ways (187893777):

    • eBPF programs match process names derived from caller-supplied paths without verifying file identities, so a caller can alter its invocation path to avoid policy enforcement.

    • lsecuritymonitorlited enumerates interpreter names once, from the file systems it can see itself, so it doesn’t recognize a Python binary that exists only in a component’s own file system.

PCC VRE

Resolved Issues

  • Fixed: pccvre now parses PCC on Google Cloud attestations in Apple Intelligence Reports and Google Cloud releases in the PCC transparency log. The Understand attestation, the transparency log, and releases cover a node’s Intel TDX, NVIDIA, and Titan-rooted evidence in the attestation and transparency-log verify-inclusion commands, and typed Google Cloud release entries in the release commands.

PCC Release 6A536500

PCC Agent

New Features

  • Safety overrides now apply to model output as well as model input. Based on the rule set, PCC Agent either matches each token once it’s emitted, keeping tokens flowing, or holds tokens in a bounded window and matches before emitting them, which is designed to keep matched content from reaching the device. (171929974, 171929930)

PCC VRE

Known Issues

  • pccvre release download may reuse a previously downloaded asset from a different Google Cloud Node Architecture release. These releases publish assets under generic filenames such as image.tar.gz, and pccvre caches downloads by filename, so a later release can pick up the earlier release’s file. This can cause pccvre release verify to report a mismatch or pccvre instance create to boot the wrong OS image.

    Workaround: Pass --overwrite to pccvre release download when switching between PCC on Google Cloud releases to force a fresh download of every asset. (184553308)

Resolved Issues

Known Issues

  • pccvre instance invoke tool cloudboard-vre-cli fails with dyld: Library not loaded: /System/Library/PrivateFrameworks/LocalCloudBoardClient.framework. To work around this, rerun the command with --debug, find the cloudboard-vre-cli path, and re-sign that binary in place with empty entitlements (codesign -f -s - --entitlements empty.plist "<tool-path>"). (183686140)

  • Shadow Tunneling fails because ShadowTunnelCloudApp and ShadowTunnelCloudController fail to launch with not allowed for Restricted Execution Mode state. To work around this, copy both binaries from a running instance into a staging directory (scp root@<instance-ip>:'/private/var/PrivateCloudSupport/usr/libexec/ShadowTunnelCloud*' <staging-dir>), and package that directory with pccvre cryptex create -S <staging-dir> -V ShadowREM, which marks every binary it packages as permitted before and after REM. Add the result with pccvre instance configure cryptex add. (183685895)

  • A VRE instance restored from a “PCC Agent Worker LLASSI” release fails to boot. To work around this, either remove the NATURAL_VOICES_SE_CV13 cryptex before you start the instance, or, on macOS 27.0 or later, create the instance with pccvre instance create --disk-size 200. (182844655)

PCC Release 6A535100

PCC Agent

Resolved Issues

  • Fixed: A secure-configuration value that selects whether a delegation-eligible tool runs in an isolated Delegated tool calls or locally on the PCC Agent is now attested. Previously, this value was read without attestation, so modifying it could cause a tool intended for an isolated workload to instead run on the agent and weaken the security isolation between use cases. (178863006)

PCC VRE

Known Issues

  • pccvre instance create fails for 6A releases with Error: The operation couldn't be completed. Bad file descriptor. To work around this, run pccvre release download with the --debug option, find the release metadata file in the output, edit it to remove the identifier and cacheable properties from all cryptex objects, then run pccvre instance create. (182410431)

New Features

Resolved Issues

  • Fixed: Encrypted thinking traces now function in the VRE. The agent automatically includes the appropriate configuration to produce them, so no manual setup is required. (178398307)

PCC Release 6A533200

PCC VRE

Resolved Issues

  • Fixed: You can now download the assets that contain models used by Embedding Generation and Speech Synthesis by using the VRE tooling as part of the 6A533200h.5 build for these workloads. (181774667, 181732651)

PCC Release 6A531700

Recitation Prevention

Resolved Issues

  • Fixed: The attestations of the server nodes used for Private Filter Service were not included in the Apple Intelligence Report. (176864434)

  • Fixed: Some blocked requests related to Recitation prevention were incorrectly treated as recitation infrastructure blocks, so the number of recitation prevention blocks could be logged and made accessible to Apple. (178401486)

PCC Releases 6A5272, 6AX5221

  • These releases serve only requests from users on the 27.0 Beta operating systems.

  • PCC release 6A5272q was a non-production release that we used solely for early internal testing with the 27.0 Beta operating systems. This release never took customer traffic, and the release notes below may not describe all issues present in release 6A5272q.

PCC on Google Cloud Preview

Known Issues

Some PCC requests from 27.0 Beta operating systems are served by PCC on Google Cloud. During the preview period, PCC on Google Cloud is gradually ramping toward the complete set of security, privacy, and transparency properties of Private Cloud Compute. We are working with security researchers and red teams to assess PCC on Google Cloud, and will launch a public security research program later this year.

Request Flow

New Features

  • Starting in iOS and macOS 27, PCC consolidates token issuance into the Client authentication, which vends One-Time Tokens to clients directly.

  • PCC accounts for the varying cost of inference requests when applying a user’s rate limit, using a privacy-preserving Cost feedback.

Known Issues

  • The keys that sign Cost feedback are not yet published to the Release Transparency. Researchers can use the transparency log to verify that only one set of OHTTP and OTT keys is in use in a given time period, but can’t yet do the same for cost-token signing keys. (181951488)

Transitive Trust

New Features

Stateless Inference

New Features

  • TIE pre-computes a Static prefix cache over Apple-supplied prompt prefixes, avoiding redundant KV cache computation across requests.

  • For multi-turn interactions, TIE can KV cache reuse produced by a previous turn, using per-turn keys supplied by the user’s device.

  • PCC can return encrypted intermediate model reasoning to the device as Encrypted thinking traces.

PCC Agent

New Features

Known Issues

  • A secure-configuration value that is read without attestation determines whether a delegation-eligible tool runs in an isolated Delegated tool calls or locally on the PCC Agent. Modifying that configuration could cause a tool intended to run in an isolated workload to instead run on the agent, weakening the security isolation between use cases. (178863006)

Visual Generation

New Features

  • Visual Generation is a new application that runs the Apple Diffusion Model on PCC to generate images for on-device features such as Image Playground and Photos editing, implemented as a new PCC Agent workflow.

  • Each request runs a staged flow in which content-safety guardrails screen the prompt and input images before the diffusion model runs, and screen the generated image afterward. For requests with large images, these stages are Inference orchestration.

Recitation Prevention

Known Issues

  • Some blocked requests related to Recitation prevention are incorrectly treated as recitation infrastructure blocks, so the number of recitation prevention blocks may be logged and made accessible to Apple. (178401486)

  • The attestations of the server nodes used for Private Filter Service are not included in the Apple Intelligence Report. (176864434)

PCC VRE

Known Issues

macOS 26.4, iOS 26.4, and iPadOS 26.4

Apple Intelligence Report

PCC VRE

  • pccvre attestation subcommands now accept Apple Intelligence Reports Inspect an attestation bundle and support parsing Base64-encoded Protobuf attestations.

PCC Release 5E290.3

Visual Lookup

New Features

Known Issues

PCC VRE

New Features

darwin-init

Resolved Issues

  • Impact: An attacker in a privileged network position may be able to leak sensitive information.

    Description: A path handling issue was addressed with improved validation.

    CVE-2026-20685: Drinor Selmanaj (Sentry) and Suresh Sundaram

PCC Release 5C235

Prefill-decode disaggregation

New Features

PCC Release 5A5264.1

PCC VRE

Resolved Issues

Known Issues

  • pccvre fails to restore TIE Proxy releases and returns the error, “TIE Proxy VRE requires macOS Tahoe 26”.

    Workaround: Use macOS Tahoe 26 and add the --skip-release-requirements-check argument to pccvre instance create. (157755443)

PCC Release 5A5214b.2

Transitive Trust

New Features

  • PCC now uses PCC proxy nodes, based on the concept of Transitive Trust, to establish the encrypted communications between the user’s device and the PCC nodes that perform the user’s request. The PCC proxy node simultaneously increases performance of request distribution while providing the ability to significantly reduce the number of PCC nodes that are able to decrypt any given user’s request, which improves the system’s resilience against sophisticated supply-chain attacks. This architecture helps meet the same performance goals while allowing the PCC Gateway to instruct users’ devices to Node selection, allowing the system to operate with a maximum value of k well below the value required by the previous approach. The PCC Security Guide reflects this new flow, though client software prior to iOS 18.5 and macOS 15.5 continues to use the previous approach of encrypting directly to k nodes. (136167375)

PCC VRE

Known Issues

  • PCC can route requests using Transitive Trust through TIE Proxy. TIE Proxy is not supported in the VRE in this build. (148253942)

  • TIE accepts images as input to perform Language model inference. The VRE demo model doesn’t currently support this feature. (147590493)