Post cover image
Photo by Declan Sun on Unsplash

July 23, 2026

Siri AI is not a chatbot overlaid on an operating system.

It is becoming an essential architectural layer of Apple’s platforms — and forcing third parties into that layer is a profound mistake.

By Hilthart Pedersen

14 min read

At WWDC 2026, Apple introduced Siri AI as an entirely new version of its assistant, powered by the next generation of Apple Intelligence. It is conversational, context-aware, and capable of acting across apps and devices. But the deeper story is architectural. Siri AI is not bolted on; it is woven into the operating system itself through a system orchestrator, Spotlight's semantic index, App Intents and toolboxes, on-device foundation models, and Private Cloud Compute. This is why the European Union's Digital Markets Act interpretation — requiring equivalent deep system access for any rival AI assistant — is not merely inconvenient for Apple. It is conceptually wrong, and it endangers the very privacy and security properties that make a personal intelligence system viable.

None

Not an Overlay, but a Platform Layer

Apple's own description is unambiguous. Siri AI is "profoundly more capable and conversational, and deeply integrated across products." It draws on personal context — messages, emails, photos, calendar events, onscreen content — and can take actions inside apps: draft a reply that matches your style to a specific recipient, extract a hotel confirmation from an old email, reframe a photo, or complete multi-step tasks that cross application boundaries. On iPhone it can be invoked by swiping the Dynamic Island; on Mac and iPad it merges with Spotlight; on Vision Pro it becomes a gaze-activated orb. A dedicated app archives conversations. Writing tools work system-wide. Visual Intelligence expands across devices.

This is possible only because of a deliberate architecture. A system orchestrator coordinates requests against the Spotlight semantic index (for personal content) and an App Toolbox (for actions), keeping the most sensitive coordination on-device. Simpler reasoning runs locally on Apple silicon. More complex requests move to Private Cloud Compute — stateless, non-persistent, hardware-attested servers whose software images are published for independent inspection. Even when the heaviest models (reportedly derived from a specialized Gemini-scale model) run on third-party silicon under Apple's control, the same privacy invariants apply: data is used only for the request, never stored, never accessible to Apple or the cloud provider, and verifiable by outside researchers.

Siri AI on macOS 27 beta

Craig Federighi has been clear: privacy in AI is non-negotiable. Most providers retain interactions by default and place the burden on users to opt out. Apple's design inverts that. Core capabilities stay local or inside a compute environment whose guarantees can be audited. The company does not train foundation models on private user data or interactions. Differential privacy is used for aggregate trends. Outside experts can inspect Private Cloud Compute.

This is not marketing language. It is an engineering claim about how an intelligence layer must sit inside a modern operating system if it is to be both powerful and trustworthy. Personal context is only useful — and only ethical — when the system that holds it is the same system that already protects the user's messages, photos, and credentials under hardware root-of-trust, Secure Enclave, and attestation.

The EU's Demand and Why It Misses the Point

Under the DMA, iOS and iPadOS are designated gatekeeper services. Regulators interpret the interoperability rules as requiring that any virtual assistant receive essentially the same deep system reach that Siri AI now has: the ability to read and send messages, access files, initiate purchases, and execute actions across apps — potentially with limited ongoing user visibility and control. Apple proposed a "Trusted System Agent" intermediary and a phased 18-month rollout to mediate that access more safely. The Commission rejected the proposals. Apple responded by withholding the full Siri AI experience from iOS and iPadOS in the EU while still shipping it on macOS and visionOS.

This standoff reveals how both sides are missing the deeper point.

The Commission's position treats an agentic system that lives inside the operating system's personal graph as if it were just another app or API endpoint that can be opened for competition. That is the fundamental category error. Once an assistant can see your messages, photos, calendar, on-screen content, and then act across apps on your behalf, it is no longer a neutral feature sitting on top of the OS. It is operating with privileges closer to a system process. Demanding that every third-party AI receive equivalent access is closer to requiring kernel-level or orchestrator-level privileges for competing vendors. The security and privacy model that makes the capability valuable in the first place cannot survive that without being fundamentally redesigned — and the Commission has shown little interest in engaging with that architectural reality.

Calling Apple's safety concerns a pretext while insisting on "equal access" without a workable mediation layer is regulatory overreach dressed up as competition policy.

Apple, however, is not a pure defender of principle either. Its language is blunt and self-serving: the Commission's interpretation would force "nearly unlimited access" and constitute a "risky experiment" on tens of millions of users. Greg Joswiak and Craig Federighi have leaned hard into the privacy and security framing, and they are not wrong about the risks. But Apple has also used the DMA as a convenient shield. Withholding Siri AI from EU iPhones and iPads while releasing it elsewhere protects Apple's tightly integrated advantage and keeps competitors at arm's length. The Trusted System Agent proposal may have been genuine engineering, but the 18-month timeline and the subsequent public blame campaign also serve Apple's commercial interests. The company wants the benefits of deep OS integration without accepting the regulatory consequences that come with being a designated gatekeeper. That is a legitimate tension, not a pure victimhood narrative.

None

The substantive problem remains. An agentic system with full personal-context awareness and cross-app agency is not a commodity feature that can be handed out like a browser choice screen or an alternative app store. Treating it as one either degrades the security model that makes the feature trustworthy or forces the platform owner to cripple its own implementation. Both the Commission's rigid insistence on parity and Apple's selective withholding fail to confront that reality.

Research Makes the Risk Concrete

Security researchers have spent the last two years documenting exactly why unconstrained agentic access is dangerous. Simon Willison's "lethal trifecta" — access to private data, exposure to untrusted content, and the ability to communicate externally — turns prompt injection into data exfiltration or unauthorized action. Mobile LLM agents evaluated across multiple studies show high success rates for adversarial content delivered through ads, notifications, webviews, or cross-app channels. Fraudulent interstitial ads succeed above 80 percent of the time against some agents. More complex workflows, including malware installation that requires navigating OS warnings, succeed against advanced multi-app agents. Attack surfaces include screen-perception gaps, misused system channels, and the classic confused-deputy problem: the agent holds privileges the user would never grant an ordinary app.

These are not theoretical. They map onto MITRE ATT&CK techniques and have been demonstrated on both open-source and commercial mobile agents. The more capable and deeply integrated the agent becomes, the larger the blast radius of a successful injection. Apple's architecture tries to shrink that radius through on-device orchestration, minimal data sent off-device, and verifiable cloud isolation. Handing the same privileges to arbitrary third-party models — each with its own training data, alignment failures, and potential for compromise — reintroduces the risk the architecture was built to contain.

The same logic applies, in part, to Android. The EU has already opened specification proceedings against Google and ordered interoperability for eleven Android features relevant to AI services, including invocation, on-screen understanding, and cross-app actions, with deadlines stretching into 2027–2028. Android's greater openness has always traded coherence and security surface for flexibility. Forcing equivalent deep access there raises analogous questions, even if the baseline platform is less tightly controlled.

Siri AI on macOS 27 beta

Users Do Not Want Vendors Fumbling the OS

An operating system is not a neutral marketplace. It is the trusted computing base that mediates every other piece of software. Demanding that every AI vendor receive kernel-adjacent or system-orchestrator-level privileges is like demanding that every browser receive unrestricted access to the process table, or that every cloud storage provider receive the ability to rewrite the filesystem. Users who value a coherent, private, predictable experience — precisely the users who choose Apple — do not want a free-for-all at that layer.

An implementation as envisioned by the EU would effectively require kernel-like, highly privileged access to the operating system. Since Siri AI is now designed, unlike AI chatbots or agents such as ChatGPT or even Gemini, as a deeply integrated, system-wide component(s) of the operating system, extending comparable access to third-party AI systems raises significant security and privacy concerns. It is simply a "don't mess with my OS" kind of thought. Personally, I would not want to grant that level of access to anyone or any external agent, and I believe many other users would feel the same.

Other vendors can and should compete. They can offer excellent chatbots, specialized agents, and app-level integrations through App Intents, the Foundation Models framework, and ordinary sandboxed APIs. Apple already routes certain world-knowledge queries to external models with explicit user consent. That is interoperability with boundaries. What the DMA interpretation appears to require is interoperability without the architectural guarantees that make personal intelligence safe.

Apple's developers and security researchers have spent years building hardware roots of trust, Secure Boot, attestation, and now Private Cloud Compute precisely so that sensitive computation can occur without the company — or anyone else — holding the keys. Outside researchers can download production software images and verify the claims. That is a high bar. Lowering it so that every AI company can "compete equally" inside the personal context graph is not progressive regulation. It is the forced dismantling of a carefully constructed trust boundary.

Siri AI succeeds or fails on whether it can be simultaneously useful and private. That combination requires deep, privileged integration with the operating system that already holds the user's life. Treating that integration as a commodity that must be shared under regulatory pressure misunderstands both the technology and the ethics of personal computing. Users should not have to choose between a less capable assistant and an open invitation for third parties to fumble with the core of their devices. The integrity of the platform is not anti-competitive. It is the precondition for trustworthy intelligence.

Siri AI is not a standalone chatbot layered on top of iOS, iPadOS, macOS, or the other platforms.

It is a system-level intelligence layer rebuilt from the ground up as part of the next generation of Apple Intelligence. Its capabilities depend on deep, privileged access to the operating system's core services.

This illustrates the breakdown of the integration architecture, based on Apple's official descriptions and technical details from WWDC 2026:

1. The System Orchestrator (the central control plane)

This is the key on-device component. Craig Federighi has described it as "key to the privacy architecture of our entire system."

The System Orchestrator:

  • Receives the user's request (voice or text).
  • Decides what personal data, on-screen context, and app actions are actually needed.
  • Routes the request to the appropriate model (on-device or Private Cloud Compute).
  • Coordinates three critical on-device resources:
  • Spotlight Semantic Index — a local, privacy-preserving index of personal content (Messages, Mail, Photos, Notes, Calendar, and third-party content that developers expose).
  • App Toolbox — the mechanism that discovers and invokes actions inside apps via the App Intents framework.
  • On-screen awareness — understanding of what is currently visible on the display (text, images, UI elements).

Because the orchestrator and these three resources run entirely on the device, sensitive personal context never needs to leave the phone or Mac unless the orchestrator explicitly decides it is required for a more complex request.

2. Model stack and routing

Siri AI uses a family of Apple Foundation Models (AFM 3 generation), some of which were co-developed with Google:

The orchestrator chooses the path. Personal context and most app actions stay local. Only the minimum necessary information is sent to Private Cloud Compute when greater capability is required. Apple states that data processed in Private Cloud Compute is never stored and is inaccessible to Apple or the cloud provider; the software images are published so independent researchers can verify the claims.

3. How personal context and actions actually work

  • Personal context comes from the on-device Spotlight semantic index. Siri can find a restaurant a friend mentioned in a text, pull a confirmation number from an old email, or surface photos from a trip — without uploading the underlying data.
  • Third-party apps participate by adopting App Intents, App Entities, and App Schemas. Developers index their content into Spotlight and declare structured actions. Once they do, Siri can reason over that content and take actions inside the app using natural language (no rigid phrase lists required).
  • On-screen awareness lets Siri answer questions about, or act on, whatever is currently displayed.
  • System-wide actions include drafting and refining text anywhere the user types (Writing Tools), editing and sharing photos, creating Shortcuts from natural-language descriptions, and more.

4. Presence across the system

Siri AI is invoked and appears in multiple native surfaces:

  • iPhone: side button, "Hey Siri," swipe down on the Dynamic Island
  • iPad & Mac: integrated into Spotlight and system context menus
  • Apple Vision Pro: floating 3D orb activated by gaze
  • Apple Watch, CarPlay, AirPods
  • A dedicated Siri app that privately syncs conversation history via iCloud

This is why Apple describes it as "deeply integrated across products" and "systemwide capabilities." It is not an isolated app that occasionally reaches into the OS; the OS itself has been extended so that intelligence is a first-class service available everywhere.

Why this matters for the earlier discussion

Because the personal context, action surface, and routing decisions are mediated by a privileged on-device orchestrator that sits at the same level as core system services, giving any third-party AI the same depth of access would mean handing over the ability to read private communications, act across apps, and operate with the same privileges — without the same hardware-rooted isolation and attestation guarantees. That is the architectural reality behind Apple's position that Siri AI is not a simple overlay that can be freely opened to other vendors.

In short: Siri AI is an OS-level intelligence service whose power and privacy both depend on being inside the platform's trust boundary, not sitting on top of it.

The Siri AI Experience with the latest 27 beta

Release Status

Apple released developer beta 4 on July 20, 2026:

  • iOS 27 / iPadOS 27: build 24A5390f
  • macOS 27 Golden Gate: build 26A5388g
  • watchOS 27: build 24R5325h
  • visionOS 27 and tvOS 27 also updated

Overall Consensus on Siri AI (from betas 1–4)

Early long-form testing (Joanna Stern, Tom's Guide, WIRED, The Verge, SlashGear, etc.) from June and early July remains the most detailed. The verdict is consistently positive: Siri AI is a major improvement and finally useful.

Strengths reported across platforms:

  • Personal context works well — it reliably pulls from Messages, Mail, Photos, Calendar, Notes, and (when indexed) third-party apps via App Intents.
  • Natural conversation and follow-ups feel far more fluid than old Siri.
  • On-screen awareness is practical (e.g., "What is this?" or acting on visible content).
  • Multi-step actions and system-wide Writing Tools are solid.
  • Guardrails are sensible (refuses medical/romantic overreach politely).

Remaining issues (still present in recent betas):

  • Occasional incorrect or incomplete answers.
  • Latency on complex/cloud-routed queries (a few seconds is common).
  • Indexing can be slow and temporarily impacts performance.
  • Some connection hiccups or "trouble connecting" messages.
  • Not yet as broad or consistent as the best competitors in pure open-ended knowledge tasks.

Platform-Specific Notes (Beta 4 Focus)

iPhone (iOS 27 beta 4) Strongest experience. Beta 4 mainly expands Siri voices: more American options plus Australian, British, Indian, Irish, and South African accents. Pace + Expressivity sliders remain limited to a couple of voices and higher-end devices (A19 Pro / 12 GB+ RAM class). New welcome/splash screen on first launch. Users report continued stability improvements and fewer freezes than earlier betas, though a few note residual notification delays or UI glitches after the update. CarPlay experience is notably more conversational and helpful.

iPad (iPadOS 27 beta 4) Very similar to iPhone. Testers highlight good productivity use (drafting, researching on-screen content, cross-app actions). Indexing can take longer on larger storage devices if the iPad is not left plugged in and idle.

Mac (macOS 27 Golden Gate beta 4) Siri AI lives primarily in Spotlight (type a question and it routes to Siri) plus a dedicated Siri app and context menus. Integration feels clean. Personal context is weaker than on iPhone if you live mostly in third-party apps. Early testers found it promising for research and file-related questions but more limited overall than the phone experience. Waitlist bypass via Terminal worked in early betas but was patched later.

Apple Watch (watchOS 27 beta 4) Siri AI arrived fully in developer beta 3 and carries into beta 4 / public beta. You can start a conversation on iPhone and continue on the wrist (history syncs privately via iCloud). Useful for quick personal-context queries and simple actions. Still described as a bit rougher around the edges than the phone version.

Vision Pro (visionOS 27) Gaze-activated floating orb works as demoed. Spatial context is a differentiator, but detailed long-term hands-ons remain limited.

Bottom Line for Beta 4

Beta 4 is primarily a polish and expansion release for Siri (especially voices and UI) rather than a dramatic capability jump. The core "it finally works and is useful" feedback from June still holds, with incremental stability and feature refinements. Expect more polishing through the remaining developer betas and the public beta cycle before the fall release.

If you're testing, keep devices plugged in during indexing, report bugs via Feedback Assistant, and note that full capability (especially the most advanced on-device model and voice customization) is limited to newer silicon.

Sources

The following sources underpin the claims about Siri AI's architecture, deep system integration, privacy design, and the conflict with the European Union's Digital Markets Act (DMA). They are drawn from Apple's official announcements, technical documentation, contemporaneous reporting, and relevant security research.

Apple Official Sources (Primary)

Reporting on the EU DMA Dispute

Technical and Architectural Reporting

Security Research on Agentic AI Risks

  • Simon Willison: "The lethal trifecta for AI agents: private data, untrusted content, and external communication" (16 June 2025). https://simonwillison.net/2025/Jun/16/the-lethal-trifecta (Framework for understanding why deep system access + untrusted inputs creates high risk.)
  • Academic papers on mobile LLM / agent security (examples referenced for the broader risk landscape):
  • "Measuring the Security of Mobile LLM Agents under Adversarial Prompts from Untrusted Third-Party Channels" (arXiv:2510.27140).
  • "From Assistants to Adversaries: Exploring the Security Risks of Mobile LLM Agents" (arXiv:2505.12981 and related).
  • Additional systematizations of computer-use / agent vulnerabilities and prompt-injection pathways in agentic systems.

Additional Context

  • European Commission materials on DMA specification proceedings for Alphabet/Google Android AI interoperability (for the parallel Android discussion). https://digital-markets-act.ec.europa.eu/ (and related decisions from 2026).