Apple Runs Private AI on Google Cloud Servers

According to Apple's Security Research blog and MacRumors, Apple is extending Private Cloud Compute (PCC) beyond Apple data centers by running some Apple Intelligence workloads on Google Cloud servers that use NVIDIA GPUs. CNBC reported Apple discussed a new AFM Cloud Pro (Apple Foundation Model Cloud Pro) model during WWDC and described it as comparable to Google's Gemini frontier models, with executives saying more advanced, agentic, or reasoning-heavy requests will be handled in the cloud rather than fully on-device. 9to5Mac published direct remarks from Craig Federighi and other Apple executives about the integration between on-device systems and cloud models.

Per Apple's Security Research post and MacRumors, the PCC-on-Google implementation layers several technologies: NVIDIA Confidential Computing with NVIDIA GPUs, Intel CPUs with TDX, and Google's Titan chip. Apple states the server-side components and software are part of a trusted computing base with verifiable transparency and no-privileged-runtime guarantees, and that Apple maintains cryptographic control over which PCC software devices will trust. Apple also says it will keep a cryptographically verifiable ledger of the Google Cloud hardware that participates in the PCC fleet to mitigate supply-chain risk. PCC on Google Cloud is rolling out through beta testing, with PCC binaries made available for public inspection and research-mode access via Apple's Security Bounty Program.

Running private AI workloads on Google Cloud and NVIDIA hardware is a material shift from early messaging that emphasized Apple Silicon and in-house-only processing. Multiple outlets, including CNBC, Macworld, and The Information, frame the move as an operational compromise to handle higher compute demands for advanced assistant features while preserving privacy properties through architectural controls. For practitioners, this highlights the operational complexity of delivering low-latency, private assistant experiences at scale when on-device compute alone cannot meet frontier-model resource needs.

Apple's stated PCC requirements, as reproduced by MacRumors and described in Apple's Security Research post, are: "stateless computation, enforceable guarantees, no privileged runtime access, non-targetability, and verifiable transparency." 9to5Mac quotes Craig Federighi describing the integration between on-device system software and cloud-hosted models and stressing that Apple's assistant does not use Google Search or Google's customer-deployed models directly.

Companies that combine on-device models with cloud-hosted frontier models typically rely on confidential computing, attestation, and software signing to bridge trust boundaries. Observed patterns in comparable deployments include hardware-backed isolation (for example, TEE-enabled CPUs and vendor confidential-compute stacks) and cryptographic verification of allowed software images. Those patterns match the building blocks Apple cites for PCC on Google Cloud.

Coverage draws on Apple briefings, Apple's own security post, and follow-up tech talks. Reporting to date includes asserted technical guarantees and planned beta steps; independent audits or third-party verification of the claimed protections have not yet been published.