Apple's Private Relay — the opt-in feature that promises to hide your IP address while browsing in Safari — can be circumvented, exposing the very address it is meant to conceal.
Researchers Talal Haj Bakry and Tommy Mysk published their findings in a blog post on Tuesday (August 4), and set up a website where anyone can check whether their real IP address leaks even with Private Relay enabled. In a test on Tuesday, TechCrunch confirmed the site revealed its real IP address. The issue was first reported by 404 Media.
The problem, the researchers wrote, lies in three features of Apple's WebKit browser engine, which powers every browser on iOS. Private Relay, available only to iCloud+ subscribers, is not a system-level VPN: it protects users only while they browse with Safari.
Mysk said on X that the team chose not to report the flaw to Apple first, citing experience: "our past experience with Apple tells us that reporting this issue would involve months of delays, inconsistent communication, and in some cases, denying the issue's impact entirely." Apple did not immediately respond to a request for comment.
Mysk and his colleagues develop a private browser called Psylo, which they say now includes mitigations that prevent IP leakage when using it.
