A vulnerability in Apple's Hide My Email service, which could expose users' real email addresses, reportedly persisted for at least two weeks after Apple claimed to have fixed it.

Apple stated it deployed a patch on July 3, 2026, to resolve the issue. However, AppleInsider successfully reproduced the flaw on July 17, two weeks after the claimed fix date. The vulnerability allowed a sender possessing a specific Hide My Email alias to potentially reveal the real address behind it with technical knowledge.

Researchers Tyler Murphy and Ben Weiner of Easy Opt Outs had been reporting vulnerabilities to Apple for about a year, with Apple declaring them fixed on multiple occasions, yet the issues re-emerged. While Apple insists the vulnerability is now eliminated, and the researchers concur it's fixed as of today, the conflicting dates highlight a discrepancy in the resolution timeline. Users are advised to treat addresses linked to aliases created before July 7 as potentially exposed, as deleting an alias might not remove information already logged by third parties.