Cellebrite May Have a New Over-the-Air iPhone Exploit

A leaked document reveals a potential new Cellebrite tool that can remotely unlock iPhones, bypassing even the latest security features from a distance.

A confidential document, reportedly leaked from the digital forensics firm Cellebrite, details a powerful new tool for unlocking iPhones. According to reporting from Justin.sh, highlighted by security expert Bruce Schneier, the product is called "Advanced Unlocks" (AU) and is slated for a 2026 release. The document claims this tool represents a significant leap in capability, allegedly functioning as a remote, over-the-air exploit. Most notably, it is said to work from a distance of up to eight meters and can bypass Apple’s most recent security features, including the newly introduced Stolen Device Protection. This leak suggests the existence of a previously unknown, or zero-day, vulnerability in the iPhone’s radio-based communication hardware.

The technical claims, if accurate, point to a sophisticated exploit targeting a device's wireless protocols, such as Wi-Fi or Bluetooth. The leak describes the tool as a “next-generation AFU vulnerability.” In digital forensics, AFU stands for “After First Unlock,” a state where a device has been unlocked at least once after a reboot, making more data accessible to investigators. A “next-generation” version implies a capability that may overcome this limitation, potentially allowing access even to a fully locked device that has been restarted. An exploit operating over the air without any user interaction would be classified as a “zero-click” vulnerability, which are among the most sought-after and dangerous types of security flaws because they are nearly impossible for a user to prevent.

This alleged development is the latest move in the long-running cat-and-mouse game between platform security teams at companies like Apple and the private intelligence and forensics industry. Firms such as Cellebrite and NSO Group operate in a lucrative market, developing and selling tools that exploit software vulnerabilities to law enforcement and government agencies. In response, Apple has continuously hardened iOS with features like Lockdown Mode and Stolen Device Protection, specifically designed to thwart these advanced attacks. A tool that can bypass these very protections demonstrates that the security arms race is escalating, with adversaries constantly finding new ways to circumvent even the most robust defenses.

For security leaders, developers, and IT teams, this news serves as a critical reminder that no platform is impenetrable. While the tool is unconfirmed and not expected until 2026, its potential existence underscores the severe threat posed by well-funded adversaries. It invalidates the assumption that physical control of a device guarantees its security. This leak reinforces the importance of a defense-in-depth strategy, where security does not rely on a single control. Organizations with high-value personnel or data should treat this as an early warning, prompting a review of mobile device management policies and incident response plans for a future where remote, zero-click attacks may become more common. The security community will be watching closely for any independent verification or further details on this alleged capability.

A potential remote, over-the-air iPhone exploit fundamentally alters the threat model for secure mobile devices. If true, it means physical access is no longer required for compromise, creating a critical new risk vector for executives, engineers, and anyone handling sensitive data.

This development highlights the sophisticated commercial market for zero-day exploits. For businesses, it elevates the risk of targeted corporate espionage against key personnel. Companies must re-evaluate their mobile security posture, as relying on Apple's built-in protections may no longer be sufficient.