Identity · 97 days ago
Apple has moved password changes from a manual recovery task to an AI action. That is convenient, but it also means the same agent that can help fix a weak login can be steered into changing account access without a human approval step.
The updated Passwords app can use Apple Intelligence and Safari to sign into a site, replace weak or compromised credentials, and save the new password in the vault. Apple says the feature works across passwords, passkeys, Wi‑Fi credentials, and verification codes, and researchers warn that agentic systems are exposed to prompt injection, retrieval poisoning, and telemetry manipulation.
For teams thinking about AI assistants that can act inside browser sessions or account portals, the control problem changes fast: once an agent can behave like a user, credential changes become part of the attack surface.
3 sources covering this story
Apple’s iOS 27 goes all agentic on compromised passwords, promises to change them with one tap
iBiz might not win the AI race, but analysts say it's focusing on features people may actually use
Apple Intelligence can now replace weak passwords without user intervention - Help Net Security
Apple Intelligence adds automated password updates to the Passwords app, helping users replace weak credentials with stronger ones.
New Apple feature automatically changes your compromised passwords
This works in Safari, and it's rolling out with iOS 27.
Part of the PlainSec briefing for 2026-06-10