Apple’s Hide My Email tool, a flagship privacy feature designed to shield users’ real email addresses when signing up for online services, contains a vulnerability that has allowed those addresses to be exposed for at least a year. Security researcher Tyler Murphy discovered the flaw in June 2025 and found that in tests with volunteers, 100% of Hide My Email addresses were exploitable. The revelation, which undermines the core promise of the feature, raises serious questions about the reliability of Apple’s privacy safeguards and the company’s responsiveness to security disclosures.<\/p>\n
Apple<\/a> launched Hide My Email in 2021 as part of its iCloud+ subscription, generating unique, random email addresses that forward messages to a user’s personal inbox without revealing that underlying address. However, Murphy discovered that the system could be manipulated to link a newly created @icloud.com<\/strong> forwarding address back to the real email address of its creator. The exact technical details of the exploit remain undisclosed because the vulnerability has not yet been patched, but the implications are immediate: anyone using the feature for privacy-sensitive registrations may have had their true identity exposed.<\/p>\n Murphy reported the problem to Apple in the summer of 2025 and was informed that the issue had been “addressed” by March 2026. However, when the researcher continued testing, the flaw remained exploitable. Apple later told Murphy that it was still investigating the issue, and the company did not respond to requests for comment when approached for this story. This delayed response, with the vulnerability persisting after a claimed fix, echoes a pattern that security researchers have criticized in the past, where bugs are acknowledged but not fully remediated in a timely manner.<\/p>\n The Hide My Email feature is widely used by privacy-conscious individuals who want to limit the amount of personal data they share with online services. A flaw that leaks the very email address the tool is supposed to conceal undermines that protection entirely. Users who rely on Hide My Email to avoid spam, data harvesting, or tracking should assume that any service they signed up for using the feature could potentially link that alias to their real address. This is especially concerning for journalists, activists, and anyone in high-risk situations who depend on Apple’s privacy tools as part of their operational security.<\/p>\n Beyond the Apple vulnerability, several other stories shaped the security landscape. A member of the European Parliament’s PEGA Committee, which investigates spyware abuses, was himself targeted with Pegasus<\/a> malware. Meanwhile, top Google security staff warned that proposed EU competition rules could make Google Search and Android systems more vulnerable to hacking. In a separate incident, Meta contractors posed<\/a> as teenagers to test how chatbots like Gemini and ChatGPT responded to high-risk topics, and a researcher used Anthropic’s Claude Opus 4.7 to break into the website of Front Gate, generating tickets for major US music festivals.<\/p>\nApple’s Response Timeline Raises Concerns<\/h2>\n
What This Means for Apple Users and Online Privacy<\/h2>\n
Other Security News This Week<\/h2>\n