The Agentic Post
Breaking
Black October 2026: Every Major AI Security Incident, Explained  ·  ARTEX: The Open-Source AI Hacking Tool Behind October’s Biggest Attacks  ·  Chinese Hackers Used AI Agents to Hit 2,250 Microsoft 365 Accounts  ·  PHP2Shell Is Now Being Exploited, and Attacks Began Before the Patch  ·  OpenAI-Backed Thrive Buys ADT for $15.3 Billion to Rebuild It With AI  ·  The AI Data Center Backlash Hits Minnesota and Australia in One Week  ·  
Home/AI News/Big Tech
Apple Intelligence Comes to China, Powered by Alibaba’s Qwen

Apple Intelligence Comes to China, Powered by Alibaba’s Qwen

Big Tech

Alibaba's Qwen will power Apple Intelligence in mainland China, with a developer preview from November 4 and launch in iOS 27.3 in December. Siri AI is not included.

AP
Staff
November 1, 2026 · 2 min read

Apple Intelligence is finally coming to iPhones in mainland China, and it will run on Alibaba’s Qwen models rather than the Google and OpenAI technology used elsewhere. Apple and Alibaba said on October 31, 2026 that Qwen will power the China edition of Siri features, Writing Tools, Visual Intelligence and photo Clean Up. Developers get a preview from November 4, with the public rollout expected in iOS 27.3 in December.

Why does Apple need Alibaba in China?

Because China requires AI services shown to the public to be registered and run on locally approved models. Apple Intelligence launched elsewhere in 2024 with iOS 18.1 but has never been available in mainland China. China’s Cyberspace Administration registered Apple Intelligence in July 2026, and Alibaba confirmed then that Qwen would power it across iOS, iPadOS, macOS and visionOS. Further approval for a consumer launch followed, and Bloomberg reported in mid-October that the December iOS 27.3 update would carry it.

Reports also say Alibaba’s Tongyi Wanxiang image models handle some image tasks, and that Baidu has a role. Alibaba has committed not to use Apple users’ requests or responses to train Qwen.

What will Chinese users get, and what is missing?

A reduced set at first. The China release covers writing and editing tools, notification summaries, photo Clean Up and visual features. It does not include Siri AI, the redesigned assistant Apple announced at WWDC 2026, and several reports say Image Playground is also left out, with text generation limited in some apps by local rules. So Chinese iPhone owners get Apple Intelligence, but a noticeably smaller version than the US one.

Why does this matter beyond China?

Three reasons. First, it is the biggest consumer deployment yet for a Chinese open model family, putting Qwen on hundreds of millions of devices. Qwen has already been competing with frontier Western models on benchmarks. Second, it confirms the split world of AI: the same iPhone runs different AI depending on where it is sold, with Google’s Gemini underpinning Apple’s foundation models elsewhere.

Third, timing. The announcement lands days after the US government ordered DeepSeek off federal systems, showing how American companies are working within China’s rules even as Washington restricts Chinese AI at home. For Apple, which has lost ground in China to Huawei’s AI-heavy phones, a working local AI story is overdue. New Apple CEO John Ternus told TechCrunch this week that Apple will use AI but not "ship AI for AI’s sake."

See TechNode’s report on the December launch.

Related

Chinese Hackers Used AI Agents to Hit 2,250 Microsoft 365 Accounts
AI Safety

Chinese Hackers Used AI Agents to Hit 2,250 Microsoft 365 Accounts
The AI Data Center Backlash Hits Minnesota and Australia in One Week
Big Tech

The AI Data Center Backlash Hits Minnesota and Australia in One Week
Zuckerberg Called Muse Ready Despite Safety Flags, NYT Reports
AI Safety

Zuckerberg Called Muse Ready Despite Safety Flags, NYT Reports
Up Next
Fake Claude Code Extension Planted SSH Backdoors on Up to 5,000 Machines

Fake Claude Code Extension Planted SSH Backdoors on Up to 5,000 Machines

AI Safety

A trojanized Claude Code extension, version 2.1.313, sat in the Open VSX store used by Cursor for 11 hours, planting SSH keys and a reverse tunnel. Up to 5,000 users affected. Update to 2.1.314.

AP
Staff
November 1, 2026 · 3 min read

A trojanized copy of the official Claude Code extension, version 2.1.313, was available in the Open VSX marketplace used by Cursor and other VS Code-based editors for about eleven hours on October 29, 2026. Simply loading it planted an attacker’s SSH key on the machine, opened a hidden remote tunnel and set itself up to survive reboots. Cursor says at most 5,000 users were affected. Anyone who installed 2.1.313 should treat their computer as compromised. A clean version, 2.1.314, was published on October 30.

What did the fake extension do?

It looked and worked like the real Claude Code extension, but carried a small hidden loader. In plain terms, it gave a stranger a permanent back door into your computer:

  • Planted a key: added an attacker-controlled SSH key, labelled svc-telemetry, to your ~/.ssh/authorized_keys file, which lets someone log in to your machine remotely.
  • Opened a tunnel: started a reverse SSH connection to an outside server so the attacker could reach your machine even behind a home router.
  • Stayed hidden: installed persistence disguised as a system service: a scheduled task called "SysMon" on Windows and a LaunchAgent named com.apple.sysmond on macOS.

No click or approval was needed beyond the editor loading the extension. The attacker’s server has since been taken offline by its hosting provider, but any key or task already planted stays until you remove it.

Am I affected?

Only if you installed version 2.1.313 from Open VSX, the extension store used by Cursor, Windsurf, VSCodium and similar editors, during the window on October 29. Users of the official Microsoft VS Code Marketplace were not the reported target. To check, open your extensions list in Cursor or run cursor --list-extensions --show-versions and look for anthropic.claude-code@2.1.313.

What should I do if I installed it?

  • Update the extension to 2.1.314 or later.
  • Open ~/.ssh/authorized_keys and delete any line ending in svc-telemetry or any key you do not recognise.
  • Remove the persistence: on Mac, delete ~/Library/LaunchAgents/com.apple.sysmond.plist. On Windows, delete the "SysMon" scheduled task in Task Scheduler.
  • Turn off remote login if you never use it (on Mac: System Settings, General, Sharing, Remote Login).
  • Rotate secrets on that machine: SSH keys, GitHub tokens, cloud keys and AI API keys, including your Anthropic key.
  • If in doubt, reinstall the operating system. Cursor’s own advice is to treat the machine as compromised.

Why do attackers keep targeting AI coding tools?

Because a developer laptop running an AI agent is a master key. It holds source code, cloud credentials and API keys, and the agent already has permission to run commands. This is the latest in a run of supply-chain attacks aimed at exactly that setup, including the poisoned LiteLLM package and GitSpawn. Open VSX has been hit repeatedly this year because it has lighter review than Microsoft’s marketplace and is the default store for several popular AI editors.

The lasting lesson: an extension carrying a trusted name is not proof it came from that company. Turn off automatic extension updates for tools that hold your keys, and check release notes before updating.

Part of our coverage of Black October 2026, every major AI security incident this month.

Powered by CookieAdmin