--- title: "The future of Siri, or: why private inference isn’t private enough" url: https://daily.dev/posts/the-future-of-siri-or-why-private-inference-isn-t-private-enough-0ksiji9fd source_url: https://blog.cryptographyengineering.com/2026/06/09/apples-siri-ai-or-more-shouting-into-the-void-about-private-agents type: article source: "Lobsters" published: 2026-06-15T03:47:54.219Z updated: 2026-06-15T03:48:34.828Z tags: ["privacy", "ai-agents", "prompt-injection"] reading_time: 15 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The future of Siri, or: why private inference isn’t private enough **[Lobsters](https://daily.dev/sources/lobsters)** · 15 min read · 0 upvotes · 0 comments ## Summary Apple's expanded Siri AI, powered by Google Gemini and a combination of Apple's Private Cloud Compute and Google's Confidential Inference, promises privacy through secure hardware inference. However, cryptographer Matthew Green argues that private inference alone is insufficient for agentic AI systems. The core problem: useful agents must interact with external services (search engines, LLMs, calendars, messaging), and each outbound interaction leaks private data. Three threat vectors are identified: (1) search engine operators (like Google) learning intimate details from agent queries, enabling data monetization; (2) prompt injection attacks where malicious content in emails or websites tricks the agent into exfiltrating private data — a 'lethal trifecta' of private data access, untrusted input parsing, and external communication ability; and (3) government surveillance, since an agent with full data access and reporting capability is technically a perfect crime-detection tool. Green concludes that cryptographic private inference only addresses one narrow adversary (the inference provider itself), while the real threats — model designers, search operators, and governments — are entirely outside its protection. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#privacy](https://daily.dev/tags/privacy), [#ai-agents](https://daily.dev/tags/ai-agents), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/the-future-of-siri-or-why-private-inference-isn-t-private-enough-0ksiji9fd)