GitHub PoC Claims an iOS Sandbox Escape, but Crypto Theft Is Not Established
A public GitHub project says its proof of concept can reach certain iOS app-related file paths. Its author also says the code is “not anything meaningfully usable at the moment, ” a key caveat when weighing claims that iPhone users’ crypto is at risk.
- The project is called bad_query, not worse_query.
- It lists iOS 26.0 through 26.6.1 and the iOS 27.0b4 beta.
- It does not demonstrate the theft of wallet secrets.
- Its claims do not establish whether Apple has issued a fix.
What the bad_query project claims
The forcequitOS/bad_query repository describes its code as a sandbox-escape proof of concept for iOS 26 and 27. An app sandbox is an operating-system security boundary that limits an app’s access to data belonging to other apps. A sandbox escape attempts to get past that boundary.
The repository lists paths the proof of concept can supposedly access, including app-data and plug-in container paths. It also names shared app-group paths. App Groups are shared storage areas that apps configured to use the same group can access. They are not general-purpose folders open to every app. The repository says accessing the App Group path on iOS 26 requires “App Group sacrifice, ” but the material provided does not explain what that condition means.
These are claims about which paths the proof of concept can reach. They do not show that it can read every file in those locations, access every app’s private data, or extract specific credentials. The repository describes the code as a developer proof of concept and says it is “not anything meaningfully usable at the moment.”
Which iOS versions does it list?
The repository lists iOS 26.0 through 26.6.1 and iOS 27.0b4, a beta release. That is the project’s stated scope, not proof that every device running those versions is vulnerable or that the code has been independently verified across the full range.
The project says the technique might also work on iOS 18, but its author had not tested it. That is speculation, not evidence that iOS 18 is affected.
The repository does not cite an Apple advisory confirming the issue or a software update that fixes it. Its claims alone do not show whether Apple has acknowledged the reported behavior or whether a particular release addresses it.
What could this mean for crypto wallets?
A recovery phrase is a set of words that can restore a self-custody wallet. A private key is a cryptographic credential used to authorize transactions. It is related to a recovery phrase, but it is not the same thing. Someone with a usable recovery phrase or private key may be able to take control of the associated funds.
The bad_query repository does not demonstrate access to recovery phrases, private keys, passwords, or wallet logins. Reaching an app-related path does not prove that a file can be read, that app-level encryption can be defeated, or that a wallet stores its secrets there.
The practical risk depends on how the wallet app stores data and whether the proof of concept can be turned into a reliable attack. The repository’s claims do not establish either point.
What should iPhone crypto users do?
Keep iOS and wallet apps updated through official channels, and avoid installing apps from unfamiliar sources. Those are sensible security habits, but they do not confirm that a particular update fixes bad_query.
A headline about a possible vulnerability is not, by itself, a reason to move funds. If you have credible evidence that a recovery phrase or private key has been exposed, treat it as compromised and create replacement wallet credentials on a device you trust. A new wallet only helps if you generate and store its recovery phrase and keys securely.
Key questions and answers
-
What is bad_query?
A GitHub proof of concept that claims to reach certain iOS app-related file paths by bypassing app isolation.
-
Does it prove crypto wallets have been compromised?
No. The project does not demonstrate the exposure or theft of recovery phrases, private keys, or login credentials.
-
Which iOS versions does the project list?
It lists iOS 26.0 through 26.6.1 and iOS 27.0b4. Its suggestion that the technique might work on iOS 18 is explicitly untested.
-
Has Apple confirmed a fix?
The project does not identify an Apple advisory or confirmed fix. Its claims do not establish whether a particular iOS update resolves the issue.
-
Should users move their funds?
Not solely because of this proof of concept. Consider replacing wallet credentials if there is credible reason to believe they have been compromised.
