Four sentences. No date. No API spec. No version string. No direct quote.
That is the entire payload Crypto Briefing published on Apple opening Siri's AI to third-party developers, and it is the most instructive artifact in the story. Glitch detected. Source traced. A crypto vertical, covering the largest consumer intent-execution layer ever announced, with fewer structured fields than a token listing announcement.
What the aggregation missed is the object itself. Apple did not ship a model. It shipped an action layer — the plumbing that lets a system read a screen, parse a mail thread, and execute a task across applications without the user opening anything. Every on-chain agent wallet currently raising in this market is attempting to build that same primitive. Apple shipped a reference implementation to a two-billion-device base and priced developer access at zero.
Reconstruct the stack. Three tiers. An on-device model in the roughly 3B parameter class, 4-bit quantized, resident on the Neural Engine. Private Cloud Compute — Apple Silicon servers, verifiable privacy — for requests that exceed on-device capacity. Third-party frontier models for the remainder. What opened is the Foundation Models framework, which exposes the on-device weights to application code, plus App Intents, which exposes application actions and content to Siri's orchestrator.
No architecture novelty. No new attention mechanism, no disclosed training objective, no alignment paper. Innovation tier: engineering and composition. Maturity: preview — which in Apple's own vocabulary means breaking changes permitted, no performance commitment, no review policy yet written.
The load-bearing detail is the delay. Personalized Siri — screen awareness, personal context — was publicly pushed in March 2025 and has not shipped. Interface first, capability later. That sequencing is the whole story, and the aggregated coverage dropped it.
Why a crypto reader should care: the AI-agent complex spent two quarters pricing a capability that Apple just conceded it cannot deliver on schedule, on hardware it controls from silicon upward.
Prompt injection is reentrancy at the semantic layer. Same bug class. Different byte.
In 2020 I pulled the cToken logic apart three hours before the major venues halted trading. The flaw was textbook: the contract treated caller-supplied calldata as authorized instruction. A confused deputy. The remedy was a trust boundary, not a patch.
Siri's action layer has no such boundary disclosed. Its input surface is mail, web pages, notifications, screen contents — every one of them attacker-writable. If the orchestrator cannot formally separate "instruction from the principal" from "instruction embedded in content the principal asked it to read," then a single crafted email is a signed transaction. Apple has published nothing on whether intent execution is sandboxed, whitelisted, or confirmed interactively.
Now move that onto a settlement layer. No chargeback. No support ticket. No reversal window. Apple's liability model for a mis-executed action is unresolved, and in a finality-by-design environment unresolved liability is not a product risk — it is a defect. In 2017 I spent forty-eight hours on a pre-sale script where the word "beta" quietly meant an integer overflow. Release vocabulary is a security disclosure if you read it that way.
NFT metadata mismatch found. In 2021 I reverse-engineered the Bored Ape metadata path and found the traits lived off-chain, mutable at the issuer's discretion. App Intents has the same shape. The intent schema, the invocation logic, and the arbitration of what counts as a valid action all sit in Apple's registry — not in anything a developer can fork, pin, or audit. The openness is an API surface, not a guarantee. Off-chain resolver, on-chain consequence. That pattern has cost this industry more capital than any single exploit.
The economics matter more than the model. On-device inference is free to the developer, so the marginal cost of an intent approaches zero across the installed base. Apple absorbs sunk silicon; developers receive the compute. Set that against every on-chain agent framework metering inference against a token. Exchange volume anomaly flagged. The AI-agent basket has been bid on a metered-compute thesis that a free, pre-installed, hardware-subsidized substitute just undercut on the consumer side.
Two further omissions.
Intent coverage is a cold-start two-sided market, and Apple already lost this game once with SiriKit. Adapters ship. Nobody invokes them. On-chain we call that wallet-connect integration theater and we price it as distribution anyway.
And load. A multi-step agent task consumes five to twenty times the tokens of a single turn. If the action layer is genuinely used, Private Cloud Compute's buildout becomes the visible bottleneck. Same shape as blob capacity priced for demo volumes and saturated inside two years. Capacity math always assumes the demo. Never the adoption. Note also the infrastructural path: Apple routes around merchant silicon almost entirely, which is a marginal negative for every compute narrative that assumes homogeneous demand growth.
The consensus trade is "Apple validates AI." Reverse it.
Apple is commoditizing the model layer on purpose. It can route to ChatGPT, Gemini and Claude in parallel, render the weights interchangeable, and retain the only non-interchangeable asset in the stack — the entry point. Model differentiation collapses into a procurement decision with a renewal date.
That is precisely the structure that kills the model-layer token thesis. Scarcity in the next cycle is not inference capacity. It is signed permission to act.
And the crowd is watching the wrong number. Everyone will benchmark Siri's reasoning. The metric that decides the outcome is routing accuracy — how often the orchestrator dispatches a task to the correct tier. Misroutes present as stupidity. They are actually a latency and trust-budget problem, and they compound silently.
One more, structural: a crypto vertical chasing Apple AI is a heat signal, not a technology signal. Attention arbitrage. Not analysis.
Two clocks. Apple's personalized Siri has already slipped once, and the first consumer-assistant loss from an injected instruction is now a matter of when. It will not be filed as an incident. It will be filed as a bug.
The question worth carrying into next quarter: when the instruction arrived inside an email, and the signature was valid, and the funds moved — who executed it?
