What 128 Leaked System Prompts Reveal About Siri's Agentic Turn in iOS 27

A catalog of 128 system prompts extracted from iOS 27 has surfaced on GitHub, and it offers something rarer than a feature list: a look at the actual instructions Apple writes for the language models running inside its operating system. The files come from two places. Some are on-disk assets shipped with a new framework called IntelligenceFlowPlannerSupport, present in iOS 27 but absent from 26.5.1. Others were recovered as __cstring literals embedded directly in the dyld shared cache, the consolidated binary blob where iOS stores its system libraries. Together they form a map of where Apple has decided to place generative AI, how it instructs those models to behave, and what it is willing to let them touch.

The headline finding is structural. iOS 27 introduces an agentic Siri planner, and the prompts that drive it are now first-class files on disk rather than constants buried in compiled code. The planner assets carry prefixes like PLANNER_PCC and PLANNER_ODM, and that distinction is the most telling detail in the entire corpus.

The argument hiding in the file names

PCC stands for Private Cloud Compute, Apple's server-side inference path that runs larger models in hardened data centers. ODM points to the on-device model. The fact that both have parallel static system prompts, parallel system-info gatherers, and parallel image-handling instructions tells you Apple is not running one assistant with an optional cloud boost. It is running two assistants with shared scaffolding, and the planner decides which one handles a given request.

The static prompts read differently depending on the destination. The PCC version opens with "You are Siri, a helpful personal assistant. You help users accomplish tasks by understanding..." while a separate catalog prompt declares "You are Siri, an intelligent assistant designed by Apple in California. You craft beautiful..." The on-device model gets a leaner introduction: "You are a helpful assistant named Siri." The asymmetry is not cosmetic. Smaller models behave better with shorter, more constrained instructions, and the trimmed ODM prompt reflects an engineering reality about what a few-billion-parameter model can reliably follow versus what a cloud model can.

The planner also separates the act of writing from the act of deciding. A file named PLANNER_PCC_agentinstr_writing_tools instructs the model that it "generate[s] written content for the user's messages and emails. Output is used directly," a warning that shapes how cautious the model needs to be when its text goes straight into a draft rather than into a suggestion the user reviews. Another, PLANNER_PCC_agentinstr_process_content_safely, branches on a query_risk_type variable that includes a self_harm_suicide case, evidence that safety routing happens inside the prompt template itself through conditional logic rather than as a separate classifier bolted on afterward.

Templates, not strings

Many of these prompts are not finished text. They are Jinja-style templates full of control flow. PLANNER_ODM_prerequest_get_system_info contains {{user_name}}{% endif %}{% if locale %} fragments, and the image-handling instructions begin with {%- if request_configuration != "ios_magic_prompt" %}. This matters because it shows the prompt is assembled at runtime from device state. The model is told the user's name, the locale, whether DRM-protected content sits in view, and whether an image is present, and the instruction set reshapes itself accordingly. The assistant you talk to is composed fresh for each request out of context the system already holds about you.

The Photos and summarization prompts go further, embedding special tokens like {{ specialToken.chat.role.system }} and {{ specialToken.chat.component.turnEnd }} directly into the text. These are the model's own chat-format delimiters surfacing in the prompt, which means the templates are being authored against the tokenizer, not just against natural language.

A server-side override channel

The most consequential discovery for anyone thinking about how these systems evolve sits in IntelligenceFlowPlannerSupport. Four diagnostic strings describe a mechanism called SystemPromptOverride. One reads "[SystemPromptDataLoader] Loading system prompt override," another "[SystemPromptOverride] Successfully loaded experimental system prompt from server data," and a third reports failure to "retrieve system prompt from server." Apple has built a path to fetch and swap in experimental system prompts from its servers without shipping a new OS build.

The implications run in two directions. For Apple, it is a sensible way to iterate on assistant behavior, run A/B tests, and patch problematic instructions quickly, the same loop that web-based AI products already enjoy. For users and researchers, it complicates the very idea of auditing what a device does, because the prompt extracted from the binary today may not be the prompt the model receives tomorrow. A corpus like this one captures a snapshot, and the override channel guarantees the snapshot has a shelf life.

The proliferation of small, specialized models

Beyond the planner, the bulk of the 128 files document something subtler than a single chatbot. Apple has scattered narrowly scoped models across the system, each with a system prompt tuned to one job. A HomeKit prompt instructs a model to act as a "HomeKit notification summarizer" that summarizes events "accurately without adding any" embellishment. NutritionCore and VisualIntelligenceCore share an "expert food analysis AI" that reads nutritional content from images. CallIntelligence parses spoken utterances during phone calls. CoreSpotlightAgenticCore alone spawns a whole staff of personas: a "Spotlight query structure analyzer," a "ranking optimization specialist," a "disambiguation specialist," a "relationship analysis specialist," and an "orchestrator for a multi-agent Spotlight search system."

That last cluster describes search itself becoming agentic. Rather than matching a query against an index, Spotlight in iOS 27 appears to decompose a question, route it through specialized reasoning steps, and reassemble an answer. The presence of a CerberusConfigCoordinator that generates system prompts from YAML, named in the OmniSearch binary, suggests a configuration-driven factory for producing these personas rather than hand-written prompts for each.

There is even a model whose job is to grade other models. GenerativeAgentsEvaluation holds prompts for a "specialized AI response evaluator," a "specialized AI systems evaluator," and an "expert tool response simulator," the machinery of an automated evaluation harness that lets Apple test assistant behavior at scale without a human in every loop.

What it means and what it does not

The broad pattern across this corpus is decomposition. Where an earlier generation of assistants tried to route everything through one large model with one large prompt, iOS 27 distributes the work across a planner that chooses between on-device and cloud execution, a fleet of single-purpose models that each know one domain, and a server channel that can rewrite their instructions after the fact. This is a coherent philosophy about how to put generative AI into a product people trust with their messages, their photos, and their phone calls: keep each model's mandate small, keep the privacy-sensitive work close to the device, and retain the ability to correct mistakes centrally.

A few cautions are worth holding onto. The catalog mixes genuine AI system prompts with ordinary __cstring literals that happen to begin with "You are," such as ReminderKit debug warnings and MusicKit sign-in errors, so the count of 128 overstates the number of true model instructions. Extracted prompts also tell you what a model is told, not how it behaves, since the same instruction produces different results across model weights and the runtime context that gets stitched in. And the override mechanism means any analysis built on these files is provisional by construction.

Still, the leak is valuable precisely because system prompts are where a company's intentions become legible. You can read in these files which tasks Apple trusts to a small local model and which it sends to the cloud, where it has placed safety branches, and how much of the assistant is assembled from your own device state at the moment you ask. The counter-perspective from privacy advocates writes itself: a server that can silently reshape the instructions governing a model with access to your mail drafts and call transcripts is a meaningful expansion of what "on-device" can quietly include. Apple's Private Cloud Compute design and its Apple Intelligence documentation address the inference side of that concern with verifiable server software, but the prompt-override path is a separate surface, and corpora like this one are how the public learns it exists at all.