iPhone has hidden list with over 100 thousand words that prevents automatic suggestions on the keyboard

A researcher reported on Friday that Apple maintains an unpublished multilingual 'grey list' containing tens of thousands of words and phrases that the iOS keyboard will not automatically complete or suggest via swipe. This list is not a complete ban, as iPhone users can still manually type any text when composing messages and emails.

However, in most cases, words from this list will not appear in autocomplete suggestions or when using swipe-to-type functionality. This offers insight into how Apple balances preventing offensive or politically charged suggestions with predicting user intent.

Since hundreds of millions of people worldwide use iPhones, Apple's decisions about which words its keyboard suggests can subtly influence how they communicate. The researcher noted that Apple has not made this list public.

Composition and Discovery of the List

According to independent researcher Derek Kaufman, who recently discovered this list, the flagged words and phrases are predominantly vulgar, offensive, or related to drugs, sex, or violence. Nevertheless, the list also contains politically sensitive phrases, such as 'Trump dictator' and 'Sleepy Joe.'

In response to Kaufman's findings, Apple did not provide direct comments regarding the size or composition of its list, nor the reasons for flagging certain political terms. The company stated that iPhone users always have the ability to manually enter the desired words or phrases and can ignore predictive text suggestions. Apple emphasized that its keyboard is configured to avoid providing inappropriate or offensive prompts.

Kaufman stated that other phrases excluded from iOS predictive text functions include 'right-wing conspiracy,' 'Tibetan independence,' and 'United Ireland.' Other languages have their own lists of flagged words and phrases. For example, in Hindi, the keyboard prevents users from swipe-typing 'Modi bhagwart' or 'Rahul from Pappu,' which is criticism of Indian Prime Minister Narendra Modi and his main opponent Rahul Gandhi, respectively.

He also reported that French speakers cannot use swipe-to-type for the phrase 'immigration too high,' and Hebrew speakers cannot input 'occupied territories.' Kaufman clarified that 'every major language has its own version of this mechanism.'

Kaufman acknowledged that Apple's aim to prevent the accidental sending of indecent messages or provocative slogans is understandable. However, he pointed out inconsistencies in the application of this feature. For instance, he noticed that 'read smut' can be typed via swipe, whereas 'read gay smut' cannot.

'This is a very soft form of censorship,' Kaufman stated. 'But on Apple's scale, even light intervention can have a big impact.'

The researcher discovered this list in September after noticing that his swipe-to-type—sliding a finger across the keyboard instead of tapping each letter—'stuttered' on certain phrases like 'bad boy' or 'white man,' but not on 'bad girl' or 'black man.' Out of curiosity, Kaufman used a combination of OpenAI's Codex and Anthropic's Claude Code to find the reason and eventually stumbled upon a dataset stored 'deep within the core' of the Apple operating system. He estimated that the conservative count of grey words and phrases is around 100,000, excluding Chinese characters.

Reuters tested a small sample of these phrases on the iPhone and found that all of them were either difficult to swipe-type or were not suggested by autocomplete. Attempts to type 'United Ireland' or 'Tibetan independence' often resulted in 'United Iceland' or 'Tibetan independences.' The phrase 'White man' yielded 'white mean,' while 'red man' or 'blue man' were entered without issues. 'Sleepy Joe' turned into 'Sleepy hope.' 'Dictator Trump' could be swiped, but the word 'trump' appeared in lowercase, and the phrase was not suggested by autocomplete; instead, the keyboard suggested 'dictator trumps.' 'Read gay smut' produced 'Read gay Smit,' while 'read smut' went through without problems.

Matt Suishe, an engineer from Tolmo, a cybersecurity firm specializing in agent AI, was able to independently reconstruct the same grey list and cross-reference Kaufman's findings with internal Apple data, achieving an almost perfect match. Suishe noted that this list had remained unnoticed for years, offering an interesting look at how 'human communication was potentially influenced and filtered over years within messengers.'

Call for Transparency

Apple, like other tech companies, has previously faced issues where predictive technologies suggested awkward or controversial text. Google's autocomplete function has regularly faced criticism and sometimes lawsuits due to suggested search queries. Last year, Apple drew public attention when users reported that dictating the word 'racist' on their iPhone briefly triggered the word 'Trump.' Apple then explained this as an error and stated it had been fixed.

David Green, Senior Counsel at the Electronic Frontier Foundation, a group protecting digital civil liberties, stated that while some find the list 'creepy' and question Apple's judgment, he sees arguments for it as a way to limit unwanted or inflammatory suggestions. Green added: 'But if they are going to do this, users must be well informed about it and have some level of customization. It should not remain a secret.'

Hackers have begun actively exploiting an old vulnerability in Apple systems to compromise browsers and steal credentials. This flaw affects users of iPhone, Mac, and iPad who have not installed the updates released in May 2024, according to The Hacker News.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added the code CVE-2024-27834 to its catalog of actively exploited vulnerabilities after confirming new attacks. This vulnerability was first presented during the Pwn2Own Vancouver competition in March 2024.

Although Apple released fixes for iOS, iPadOS, macOS, tvOS, watchOS, and Safari two months later, devices without updates remain vulnerable. This can happen either due to user forgetfulness or the need to keep older versions for compatibility with legacy software.

To spread the attacks, criminals compromised the Plerdy SEO Tracker tool, which administrators use to monitor website traffic and visits. Furthermore, they created fake pages and infected legitimate portals.

The infection occurs while using Safari. JavaScript code detects the device model and checks if the system is outdated. Upon detecting a vulnerable version, the exploit runs without requiring any action from the victim, such as clicking a link or downloading files.

The primary goal of the attackers is to capture session cookies—small pieces of data stored in the browser that maintain the user's connection to services without requiring password re-entry upon each access. With these records, criminals can clone the victim's session on another computer and gain access to email and work platforms. This method also allows bypassing two-factor authentication (2FA), which usually requires a temporary code in addition to a password.

The attacks are linked to the APT29 group, also known as Cozy Bear or Midnight Blizzard, which is associated with Russia's Foreign Intelligence Service. CISA also warns users in Brazil: Apple devices that have not yet received the patches remain susceptible to exploitation of this vulnerability. Therefore, it is crucial to check for pending updates on iPhone, iPad, or Mac and install them to protect devices. The article about the old Apple vulnerability being reused to steal data from iPhones first appeared in Olhar Digital.

Apple announced that it is aware of issues with the internal screen of its first foldable phone, the iPhone Duo, and has committed to replacing affected units.

Since its launch last Friday (23rd), some consumers have begun reporting failures in the device's internal panel. According to reports circulated online, these failures manifest as bright horizontal lines emerging from the area near the hinge.

In response to these occurrences, Apple confirmed on Monday (26th) that the problem affects only a 'small number' of devices. The company advised customers who find screen defects to contact AppleCare to request a device replacement.

A company spokesperson informed CNBC: 'We are aware of an issue affecting the internal screen of a small number of iPhone Duo units. If users experience problems with the iPhone Duo screen, they should contact AppleCare to request a replacement.'

The initial cost of the device is US$ 1,999 (equivalent to R$ 21,999 in Brazil). For cases where the device is not covered by warranty, the repair of the internal screen costs US$ 999 (approximately R$ 5,400), as detailed on Apple's support page.

Internal screen failures are a known challenge in the foldable phone market since 2019, when Samsung introduced a model with this format, and reviewers noted cracks and panel malfunctions during normal use.

Screen durability remains a factor that may limit the wider acceptance of this type of technology. Despite recent issues, initial reviews of the iPhone Duo praised the user experience with the device open, especially for multitasking and media consumption tasks.

However, reviewers also pointed out that many applications were not yet optimized to take advantage of the larger and wider screens. Apple assured on Monday that developers are already working on adapting their software to the new format. A company representative stated that the initial reception of the iPhone Duo was 'extremely positive,' and that they are observing interesting progress from developers who are quickly updating their apps to leverage the device's unique design.