Security researchers Talal Haj Bakry and Tommy Mysk disclosed that Apple iCloud Private Relay can be bypassed in some cases, allowing websites to learn a user real IP address even when the feature is enabled. Private Relay is an iCloud+ feature that routes Safari traffic through separate relays so websites do not directly see a user exact IP address and Apple does not see the website being visited. The reported Private Relay issue is especially sensitive because it sits inside WebKit, the browser engine Apple requires third-party browsers to use on iOS. Keep software updated, avoid assuming that Private Relay hides everything, and use a trusted VPN if the goal is broader network-level privacy across apps. Apple generally has a stronger privacy reputation than most large tech companies, but reputation does not remove the need for technical scrutiny.