"a next-generation AFU vector that is more resilient to Apple's OS changes" — Cellebrite
That is the phrase quoted in a confidential Cellebrite document leaked to researcher Justin.sh, according to reporting made public this week. The leak, and a separate press release from earlier this year, identify a new Cellebrite capability called Advanced Unlocks (AU) that the company is positioning as a 2026 product.
Cellebrite's "Advanced Unlocks" (AU) product
Cellebrite uses the shorthand AU for Advanced Unlocks and distinguishes it from the “advanced unlocking services” the company has marketed in prior years. The company's own press materials — cited in the leaked document and confirmed by a press release from earlier this year — present AU as a new offering slated for 2026.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleThe "next-generation AFU vector" claim (AFU = after first unlock)
The leaked document calls AU a “next-generation AFU vector.” The document explicitly defines AFU as “after first unlock,” and claims AU is “more resilient to Apple's OS changes.” That wording frames AU as a technique intended to function despite updates to Apple’s operating systems, per Cellebrite's description in the leaked material.
Stolen Device Protection and tightened USB restrictions
The document states that AU “works with Stolen Device Protection enabled,” a configuration described in the leak as one that “tightens USB restrictions.” In other words, the capability documented by Cellebrite is presented as operating even when that protective configuration is active, according to the leaked text.
Enabled by a dedicated appliance with a stated range of about 8 meters
The leaked material also describes AU as “enabled by a dedicated appliance with a stated range (!) of about 8 meters.” The exclamation point appears in the original leaked wording and the document places emphasis on the stated distance. Beyond that quoted line, the leak does not furnish further technical detail in the material reviewed by Justin.sh as cited in the report.
What this means for technologists, policymakers, and end users
- Technologists and security teams: Security engineers and device defenders will note three specific claims to verify — resilience to OS changes, compatibility with Stolen Device Protection, and operation via a dedicated appliance with a stated ~8-meter range — and will watch for technical details that substantiate those claims.
- Policymakers and regulators: Regulators and procurement officials will be presented with a new product claim for 2026 and a leaked assertion that it functions under stricter device protections; those actors may judge the need for clarification, oversight, or procurement review based on verifiable technical evidence.
- End users and the general public: The leaked description links AU directly to protections that tighten USB restrictions; for device owners, the document’s claim that AU “works with Stolen Device Protection enabled” is the concrete statement that will shape questions about the efficacy of that protection in practice.
The public record assembled by the leak is specific about three points: the product name (Advanced Unlocks, or AU), the self-described technical posture (“next-generation AFU vector” and AFU = after first unlock), and two operational claims (compatibility with Stolen Device Protection and a dedicated appliance with a stated range of about 8 meters). Those are the facts the leaked Cellebrite document presents, as reported by Justin.sh and summarized in the press material referenced earlier this year.
Absent further technical disclosure in the leaked document itself or corroborating testing, the claims stand as the vendor’s assertion. The next concrete step will be the release of more detailed technical information, independent analysis, or vendor demonstration that can be examined against the three explicit claims the leak contains.
