AI in the loop — how entitlements hide a macOS sandbox-escape surface.

A team of researchers (l_m_h, Yinyi Wu, Yingqi Shi, Yuchong Xie, Cheng Li, Yizhuo Wang) found a large, quietly overlooked attack surface on macOS: PID-domain services. These are system services that a sandboxed app can register and launch inside its own namespace, yet which carry entitlements (embedded privilege grants) the app itself lacks. The gap between "same sandbox" and "different entitlements" is where bugs live. To search it at scale they built an LLM-assisted static-analysis framework that enumerates reachable service APIs, uses an LLM to map entitlements to sensitive operations, then runs lightweight taint tracking. Result: 302 PID-domain services, 2,394 exposed APIs, 19 acknowledged vulnerabilities and 7 CVEs from Apple.

Post 23 of my Black Hat Asia 2026 series. All findings were disclosed and fixed by Apple. I explain the model and the method, plus the classes of impact the researchers showed, without service-level exploitation steps.

1. Background: sandbox and delegation

Without the macOS App Sandbox, an app can touch all of the user's data and system resources. With it, the app is confined to its own container. But real apps still need things the sandbox denies, so macOS uses a service delegation model:

• The requestor (a low-privilege app) sends a request.
• The deputy (a more privileged service) performs the operation on the app's behalf.
• They talk over XPC, Apple's inter-process communication.

The security of this model depends entirely on the deputy carefully checking who is asking and what is being asked. It is the classic confused deputy problem: a privileged helper that can be tricked into doing something for a caller who could not do it themselves.

2. What is a PID-domain service?

Most XPC services live in a global namespace. PID-domain services are different: they are registered into an app's own namespace (keyed to its process ID) and launched on demand. About 40% of macOS system services are of this type. Two properties matter:

1. They are launched with the same execution context as the requesting app and run inside either a service sandbox or the application's sandbox.
2. Because they are registered in the app's namespace, the app can reach them even though they are system services.

3. The "Chekhov's Gun": entitlements

A puzzle drives the research: if the app and the service run in the same sandbox, why can the service reach sensitive resources the app cannot? The answer is entitlements. These are key-value privileges embedded in a binary's code signature that tell the OS what extra capabilities it may use. They interact with other protections: an operation may be blocked by the sandbox, then separately checked by SIP or TCC (the privacy consent system), and an entitlement can satisfy those checks.

So the sandbox is not the only privilege boundary. The entitlement is a hidden boundary. If an entitled PID-domain service exposes an API that an unprivileged caller can steer, the sandboxed app inherits, indirectly, the service's entitled powers. Earlier public work looked at parts of this (new APIs that make Apple's PID-domain services reachable, and a way to register third-party ones into a privileged process), and the authors observe that those APIs share the same low-level code path in the XPC library and ultimately message the launch daemon. The wider surface, viewed through entitlements, stayed largely unexamined for years, probably because earlier research had different goals.

4. The method: LLM-assisted static analysis

Manual review of hundreds of services and thousands of APIs does not scale. The framework has three ideas: Source (what can an attacker call), Sink (what is dangerous, guided by entitlements), and taint flow (can the first reach the second).

4.1 Find reachable services

Not every service is a target: many verify the caller, for example by checking the caller's entitlements. The tool performs data-flow analysis backward from the connection-check's return value to see whether the check can really be satisfied or is effectively a rejection for unprivileged callers, and excludes inaccessible services. It then identifies the exported APIs by locating where the service declares its interface protocol.

4.2 Build the sink list with an LLM

Earlier work used hand-collected lists of sensitive operations, which were incomplete. Here a definition of sensitive operations (covering sandbox and TCC) is combined with decompiled function data, and an LLM builds a comprehensive sink list.

4.3 Map entitlements to capabilities

Entitlement names often imply what they allow, but the meaning of many private ones is undocumented. The pipeline scrapes public entitlement data and uses an LLM with retrieval (RAG) to infer an entitlement-capability table, then verifies and filters the result. A second LLM task decides whether a given sink function could exploit the capability granted by a specific entitlement, using noise-aware prompting and self-reflection to improve accuracy.

4.4 Lightweight taint tracking

Finally, a call graph is built from sources to sinks and taint is propagated within each function and across three call styles (block callbacks, Objective-C methods and C functions). If attacker-controlled data can flow into the parameters of a sensitive call, the candidate is reported for human confirmation.

5. Results

The deck walks through three representative issues to show the kinds of impact:

• CVE-2025-43273: a media-validation service in the CoreMedia framework that allowed a sandboxed app to read arbitrary files, a sandbox escape. The service handles sandbox extensions, which act like authorisation tokens for file access.
• CVE-2025-43365: a helper in a metrics framework whose entitlements let an unprivileged sandboxed app terminate a root process, a privileged-action-by-proxy problem.
• CVE-2025-24249: an installer-related helper running without a sandbox that leaked whether files exist, giving a side-channel for file enumeration across the whole system to a sandboxed app.

Note the range: file read, process control, and an information leak. None needs memory corruption; each is a logic flaw where a legitimate feature of a privileged helper can be steered by an untrusted caller.

6. Lessons

For platform vendors

• Treat every reachable helper as a trust boundary, and enumerate them by entitlement, not only by sandbox profile.
• Validate the caller for every exported method and validate arguments (paths, PIDs, flags) as if they came from an attacker.
• Prefer least-privilege entitlements on helpers and avoid running entitled helpers unsandboxed.

For app and security engineers

• Audit your own XPC services: who can connect, and what does each exported method do with caller-controlled input?
• Do not rely on obscurity ("the API name is private"). Static analysis can enumerate protocols and exported methods automatically.

For researchers

• LLMs are a practical knowledge layer for binary analysis: mapping semantics (what does this entitlement mean?) that used to require manual reverse engineering.
• Keep the pipeline hybrid: LLM reasoning, deterministic taint analysis, and human confirmation, with verification and filtering steps to reduce noise.

Takeaways

• PID-domain services (about 40% of macOS system services) are reachable from sandboxed apps and form an overlooked user-space attack surface.
• Entitlements are a hidden privilege boundary beyond the sandbox: same sandbox, different powers.
• An LLM-assisted static analysis pipeline made large-scale review feasible: 302 services, 2,394 APIs.
• Outcome: 19 acknowledged vulnerabilities and 7 CVEs, including file read, root-process termination and file-existence side channels.
• Design lesson: enumerate helpers by entitlement and always validate the caller and its arguments.

References & further reading

• Black Hat Asia 2026 — this talk's official page — abstract, speaker bio, and slides/video when posted.
• Official talk recording on YouTube — Black Hat channel.
• Black Hat Asia 2026 — full Briefings schedule — every talk in the conference.
• Apple XPC documentation — the IPC mechanism at the centre of the talk.
• Apple security releases — where the CVEs above are credited.
• Microsoft: analysing CVE-2025-31191 — background on sandbox extensions, cited in the deck.