macOS 27 Siri AI: OpenAI Default, Claude Hacked In

Apple shipped iOS/iPadOS/macOS 27 with "Siri AI" on September 14. Within 24 hours, two independent camps had cracked at the new AI plumbing from opposite directions — and one of them read the lock.

What shipped — and what it leaks

mpociot/claude-siri-ai hit 117 stars in its first day: a Swift bridge that registers Claude Code as a Spotlight "Ask" provider on macOS 27. It works — provider discovery, consent, streaming responses into Apple's native UI. But the conditions are the tell: it requires SIP and AMFI disabled and uses private, beta-specific APIs. And while reverse-engineering the provider framework, the author found the private selectedLLMId/defaultLLM APIs resolve to com.apple.openai.chatgpt. Apple's "open" AI layer has exactly one first-class citizen, hardcoded. The extension point exists; the default is already sold.

The same plumbing, attacked from the other side

Hours after release, airlift published a proof-of-concept sandbox escape for iOS 27.0 (RC build 24A435) that abuses the AirTraffic Mac-pairing path over Wi-Fi or USB — no app required — with verified file writes in /var/mobile/Library/SMS, SpringBoard, Safari, and app containers. Different subsystem, same lesson: the new release's most interesting attack surface isn't the UI, it's the machine-to-machine plumbing Apple bolted underneath it.

My read: Apple shipped the pipe, not the product. A pluggable LLM provider layer means the "Siri moat" is now a routing table — and the first day showed third parties will fill it (with SIP off) while exploit devs walk through the pairing path. Watch which model becomes the first real default through the public path, not the private one.