On 12 November 2026, Apple published the first detailed technical account of Secure Exclaves, a separate operating system that runs alongside iOS and macOS on Apple silicon and processes camera and microphone data that the main kernel cannot access.
The post on the Apple Security Research blog, written by the company’s Security Engineering and Architecture (SEAR) and Core OS teams, says the design protects always-on sensing on the HomeView smart display, iPhone 18 Pro, iPhone 18 Pro Max, iPhone Duo and MacBook Neo.
The problem Apple set out to solve is ambient sensing: features such as “Hey Siri” detection and HomeView’s recognition of up to six household members require the microphone and camera to run constantly.
A recording light would therefore glow all day, telling users nothing. Apple’s answer is two modes. In ambient mode, raw audio and video remain within an exclave, are reduced to a small signal and are then discarded. In active mode, full sensor data is released to the operating system, and only after an indicator is shown.
Apple states that data handled this way “cannot be accessed by the main operating system, apps, or Apple.” On HomeView, the camera and audio exclaves detect that someone is present; a person recognition exclave computes face and voice prints on an isolated Neural Engine queue; and the main OS receives three values: an identifier, a position, and a confidence score.
Swift, A Microkernel And Machine-Checked Proofs
Secure Exclaves sit on three layers. At the bottom is the Secure Page Table Monitor (SPTM), a component loaded separately at boot that runs at a higher privilege level than the XNU kernel and is the only code allowed to write page table entries, the structures that decide which memory a program can touch. Above it runs a small capability-based microkernel, a kernel stripped to the minimum set of functions, and on top of that, exclaveOS, which hosts the individual exclaves for camera, audio, Siri, person recognition, secure storage, and the Neural Engine.
Memory safety is applied where Apple could rewrite. Significant portions of exclaveOS are written in Swift, as is Secure IPC, the messaging layer that defines exactly which fields may cross from an exclave to the main OS. Apple says each of those interfaces is audited so that only the metadata a feature needs can leave.
The microkernel itself remains C, and Apple is using formal verification, mathematical proof that code matches its specification, to cover that gap. Engineers modelled the kernel in the Isabelle/HOL proof assistant with the AutoCorres2 tool. The work is incremental and does not yet cover the whole kernel, but Apple says it has already exposed incomplete system call validation, malformed page table updates, misaligned reads and a flaw in how capabilities were sent between processes.
The indicator is enforced in the same way. On iPhone 18 Pro, an Always-On Processor makes the first pass on “Hey Siri”, the audio exclave cancels echo, and a Siri exclave confirms the phrase. The Siri daemon in iOS gets only a wake flag. A component called the Exclave Indicator Controller then asks a display exclave to check the rendered pixels through a hardware block, including colour, shape, brightness and whether anything is covering them, and audio is released only once that check passes. The indicator stays visible for at least three seconds.
What Outside Researchers Have Found
Until this week, almost everything public about exclaves came from reverse engineering. Researchers Moritz Steffin and Jiska Classen published a study of SPTM and exclaves in October 2025 that concluded the changes do raise system security by moving sensitive components out of XNU’s reach. They also noted that they had to work from binaries because Apple had released neither source code for the secure side nor official documentation for SPTM. Apple’s post is the first official description of an architecture that outsiders have spent two years mapping by hand.
Not every assessment has been favourable. iOS security training firm Antid0te, which built its own platform for running the exclave kernel under a debugger, wrote after reading the code that it found little about the Secure Kernel that lived up to the name. Apple’s disclosure that formal verification found real bugs in the same kernel is consistent with a codebase still being hardened.
The groundwork dates back several releases. The Register reported in March 2025 that exclave references in XNU source for the M4 and A18 chips pointed to a redesign of the kernel’s security model, with a researcher describing it as an attempt to gain microkernel-style isolation without abandoning XNU. HomeView, a $299 display that went on sale on 13 November 2026, is the first product built around the result.
Several questions remain open. Apple’s post names no chip generations or OS versions, does not say whether exclaveOS source will be published for independent review, and gives no schedule for completing the kernel proofs. The company says its next steps are to expand formal verification coverage and to pursue AI-assisted vulnerability research. Users do not need to change any settings; the protections are on by default on supported devices.
Community Discussion
Join the conversation. Ask questions, share solutions, and help others.
Be the first to start the discussion!
