The Foundation Models API Hides the Privacy Boundary by Design

On June 15, 2026, Anthropic published ClaudeForFoundationModels, a Swift package that makes claude-sonnet-4-6 and claude-opus-4-8 available as server-side language models in Apple’s Foundation Models framework. Developers targeting iOS 27 and macOS 27 can now drive Claude with the same LanguageModelSession API they use for Apple’s on-device model — the same method calls, the same response types, the same streaming interface. Swap the model argument, get Claude. The code is identical in shape. The privacy architecture is not, and the framework does not say so.

Apple’s official documentation for the package states the relevant fact plainly: Apple is not in the request path and does not see prompts or responses. That sentence is more disclosure than most third-party SDK integrations provide. It is also the entirety of what the API surface communicates about where users’ data goes. Whether users themselves see any indication of this — whether the OS, the interface, or the moment of inference distinguishes between a call that stays on device and a call that routes to Anthropic’s infrastructure — is a developer choice that the framework does not enforce.

What the Foundation Models Framework Actually Is

Foundation Models is a new API in iOS 27 and macOS 27 that treats AI inference as a platform service. SystemLanguageModel is the default: Apple’s on-device model, fast, fully private, capable offline, sized for everyday tasks. The framework defines a LanguageModel protocol that any implementation can conform to. As of the OS 27 betas, that protocol supports both on-device models and server-side providers through a shared interface: respond(to:), streaming, guided generation, tool calling.

Anthropic’s package conforms ClaudeLanguageModel to that protocol. From the app’s perspective, the call looks like this: initialize a ClaudeLanguageModel with a model name and authentication mode, pass it to LanguageModelSession, call respond(to:). Replace ClaudeLanguageModel with SystemLanguageModel.default and the call structure is identical. This is the explicit design goal. Apple’s on-device model and Anthropic’s cloud model share the same public surface. Apps can switch between the two by swapping the model: argument. The engineering is clean. The abstraction does exactly what abstractions are for: it hides the implementation.

The package is in beta at version 0.1.0. It supports sonnet4_6 and opus4_8 as compiled-in model constants. Claude Fable 5 — Anthropic’s most capable widely released model, launched June 9 — is not yet a compiled-in constant; using it requires an explicit capability declaration. That detail tells you the package was cut against the previous generation. It is a minor friction. It is also a reminder that the gap between frontier capability and framework support is real, and that an app’s on-device escalation path benchmarks against whatever Claude version the developer locked at build time, not the current API state.

Three Privacy Tiers Under One Method Call

Apple has built a three-tier privacy architecture for AI inference in iOS 27, and Foundation Models spans all three without announcing which tier a given call uses.

The first tier is on-device inference. Computation happens on Apple Silicon in the device. Nothing leaves it. Apple cannot see it. Anthropic cannot see it. No external party can see it. This is the strongest privacy guarantee Apple has shipped in a software feature, and it is the default behavior for Foundation Models.

The second tier is Private Cloud Compute. Complex Apple Intelligence tasks that exceed what the on-device model can handle are routed to Apple-managed servers with hardware attestation. PCC’s guarantees — stateless computation, enforceable privacy, non-targetability, verifiable transparency — are backed by attestation mechanisms that Apple itself cannot bypass. In the most recent expansion described in Apple’s security blog, that infrastructure now runs on NVIDIA GPUs inside Google’s data centers, using Intel TDX and Google’s Titan chip to maintain the attestation chain. Apple’s PCC is, architecturally, a bet that mathematical proof is more reliable than institutional promise. The proof is auditable by independent researchers.

The third tier is what ClaudeForFoundationModels is: a standard HTTPS connection to api.anthropic.com. No hardware attestation. No PCC. No Apple-controlled privacy layer between the request and Anthropic’s infrastructure. Requests go to Anthropic. Anthropic’s standard data practices apply. Billing goes to the developer’s Anthropic account. This is how most of the internet works — a TLS connection to a vendor API — and there is nothing unusual about it in that context. The context here is that it sits under the same LanguageModelSession call that, one model: argument away, delivers a PCC-attested inference. From the app layer, both are calls to the same method. One invokes a hardware-backed privacy proof. The other invokes a subscription billed at $3 per million input tokens.

The Threat Model Matthew Green Identified Before the Package Shipped

On June 9, 2026, Johns Hopkins cryptographer Matthew Green published a post arguing that Apple’s private inference architecture is inadequate for the AI-agent use cases Apple is describing. His argument is architectural, not a critique of Apple’s implementation quality. Private inference protects data during processing. Useful AI agents process data and then act on it — search the web, send messages, read files, execute code. The moment an agent talks to an external service, the privacy of the data involved is no longer a function of the inference layer. It is a function of what the external service does with whatever the agent sent it.

Green names this the lethal trifecta of AI privacy risk: private data access, plus untrusted content parsing, plus external communication ability. All three together produce a system that can be induced, through carefully crafted external content, to exfiltrate sensitive user data to attacker-controlled infrastructure. This is the prompt injection attack surface that has been studied since 2023, now assembled in a system that has read access to personal data the user never directly shared with a web browser.

ClaudeForFoundationModels ships three server-side tools as first-class features: web search, web fetch, and code execution. These run on Anthropic’s infrastructure within a single round trip. An app that gives a Claude session access to a user’s personal documents and configures web search with maxUses: 5 has assembled Green’s trifecta by design: private data access, external content parsing, outbound queries to search infrastructure. None of this is misuse. It is what server-side AI with tool access is for. But the trifecta Green identified as a structural risk is also the core use case the integration enables, and it runs entirely outside the PCC envelope that Apple uses for its own cloud inference.

The counterargument deserves a direct statement. Anthropic publishes a privacy policy. The integration’s documentation is explicit about what crosses what boundary. Developers who choose to build with this integration are making an informed choice about Anthropic’s data handling for their users. That is how informed consent works at the developer level. It is the standard tradeoff in any cloud API integration, from Stripe to Twilio to every SaaS tool that touches user data. Green’s critique is not that Anthropic is untrustworthy — it is that any system with these three capabilities faces structural attack vectors that no amount of institutional trustworthiness prevents. The attack is against the system’s architecture, not against Anthropic’s intentions.

Who Knows What When

In an iOS 27 app, a user who taps a feature that runs an AI query does not know from the interface which of the three privacy tiers their data is going to. The code uses LanguageModelSession either way. The developer knows. The developer decided. The user’s awareness of this decision is whatever the developer chose to put in a settings screen or privacy disclosure.

Apple’s App Store privacy labels require declaring when user data contacts external parties. An app built with ClaudeForFoundationModels would need to declare that user data is sent to a third-party API. This mechanism is real and it is the right one for the App Store review layer. But it operates at the app level, in text, before a user installs the app, not at the feature level at the moment inference happens. There is no runtime UI that distinguishes on-device inference from cloud inference at the moment of a query. The user sees an AI feature responding. The infrastructure it ran on is a disclosure buried in a privacy label they read once at install time, if at all.

Compare this to PCC’s transparency architecture. Apple’s PCC logs are published for independent security researchers to audit. The hardware attestation is cryptographically verifiable. Users who care can confirm, through published third-party audits, that Apple’s cloud inference actually works the way Apple says. There is no analogous user-facing verification mechanism for whether a given Foundation Models call routed to PCC or to a third-party API. The architecture trusts the developer to disclose correctly. The developer trusts the framework to route correctly. The framework trusts the model: argument passed at session creation. This is how software layering works, and it is not Apple’s failure. It is the structural reality of a platform that supports multiple privacy tiers through a single unified API.

ClaudeForFoundationModels is not a problem Anthropic created. It is the first instance of a design choice Apple made when it defined the LanguageModel protocol as extensible. The protocol was always going to have server-side providers — the framework documentation describes this from day one. Anthropic is the first named occupant of that server-side slot, and they did nothing unusual in taking it. What the arrival of the first third-party server-side provider clarifies is that Foundation Models is not a privacy guarantee. It is a developer convenience that can be used to deliver private AI or to deliver cloud AI, depending entirely on what model: argument is passed at session initialization. Apple built the architecture that enforces strong privacy at the on-device and PCC tiers. Below the protocol conformance layer, the privacy contract is the developer’s to define and the user’s to discover.

AI-generated editorial illustration · TemperatureZero · June 15, 2026