Apple's expanded Siri AI, powered by Google Gemini and a combination of Apple's Private Cloud Compute and Google's Confidential Inference, promises privacy through secure hardware inference. However, cryptographer Matthew Green argues that private inference alone is insufficient for agentic AI systems. The core problem: useful agents must interact with external services (search engines, LLMs, calendars, messaging), and each outbound interaction leaks private data. Three threat vectors are identified: (1) search engine operators (like Google) learning intimate details from agent queries, enabling data monetization; (2) prompt injection attacks where malicious content in emails or websites tricks the agent into exfiltrating private data — a 'lethal trifecta' of private data access, untrusted input parsing, and external communication ability; and (3) government surveillance, since an agent with full data access and reporting capability is technically a perfect crime-detection tool. Green concludes that cryptographic private inference only addresses one narrow adversary (the inference provider itself), while the real threats — model designers, search operators, and governments — are entirely outside its protection.
