[CVE-2026-20685] Beyond Prompt Injection: Hacking Apple's Private Cloud Compute

CVE

CVE-2026-20685

Published

2026-07-31 13:06

Collected

2026-09-02 22:51

---
id: 7443
title: "[CVE-2026-20685] Beyond Prompt Injection: Hacking Apple's Private Cloud Compute"
cve: CVE-2026-20685
source_domain: blog.sentry.security
source_url: "https://blog.sentry.security/beyond-prompt-injection-hacking-apples-private-cloud-compute/"
published_at: "2026-07-31T13:06:06Z"
tags: ["ai-security", "bug-bounty", "cloud", "path-traversal", "apple", "private-cloud-compute", "cve-2026-20685"]
phying_url: "https://phying.com/item/7443"
lang: en
---

# [CVE-2026-20685] Beyond Prompt Injection: Hacking Apple's Private Cloud Compute

## Summary

Sentry researcher Drinor earned a $150,000 bounty for CVE-2026-20685, a path traversal in darwin-init that allowed root file writes on Apple's Private Cloud Compute and redirection of node telemetry.

## Intelligence Metadata

- **Sources:** blog.sentry.security
- **CVE:** CVE-2026-20685
- **Published:** 2026-07-31T13:06:06Z
- **Original:** https://blog.sentry.security/beyond-prompt-injection-hacking-apples-private-cloud-compute/
- **Phying News:** https://phying.com/item/7443