Apple removes iPhone Endpoint Security kernel extension in iOS 27.2 beta 2

Why it matters

Endpoint Security underpins Mac endpoint-detection tools. Its brief appearance in iOS showed Apple testing similar visibility on research iPhones, while beta 2 removes the kernel component needed to provide it.

Apple removed an experimental Endpoint Security kernel extension from iOS 27.2 beta 2, reversing one of the more consequential security additions found in the first beta.

Apple security researcher Blacktop (@blacktop__) flagged the removal on September 21st, posting a firmware-diff screenshot showing com.apple.iokit.EndpointSecuritySE under a single-item "Removed" list. Blacktop maintains ipsw, an open-source toolkit for inspecting and comparing Apple firmware, kernel caches and system binaries.

The underlying ipsw-diffs comparison confirms the change between iOS 27.2 beta 1, build 24B5084k, and beta 2, build 24B5089g. The newer build's kernel no longer includes the Endpoint Security extension.

Apple pulled the kernel component

Endpoint Security is the low-level framework that security vendors use on macOS to monitor system activity. Apple's developer documentation describes a C API that can notify clients about process executions, file-system activity, mounted volumes and other sensitive operations. On macOS, authorized clients can also receive pending events and decide whether an operation should proceed.

Its appearance in iOS 27.2 beta 1 immediately raised the prospect of deeper endpoint monitoring on iPhones. A September 18th technical analysis by Calif researcher Josh Maine found both the com.apple.iokit.EndpointSecuritySE kernel extension and /usr/lib/libEndpointSecurity.dylib in the beta 1 image.

That implementation was heavily restricted. Maine found that the kernel extension initialized only on Apple's Security Research Devices running in research or extended-research mode. Retail iPhones would leave it inert. The available subscription filter accepted 37 event types, all notification events or events inferred to be notification-only. The code therefore appeared capable of observing selected activity after it occurred, without giving a client authority to block the operation.

The beta 1 implementation also lacked the supporting endpointsecurityd and sysextd services used on macOS. Apple's watchdogd, which monitors system services, was the only binary Maine found with the required embedded-client entitlement. His analysis found no Endpoint Security subscription calls in that process.

Those constraints already made the beta 1 code an internal research facility rather than an opening for antivirus vendors. Beta 2 goes further by removing the kernel extension that supplied the framework's kernel-side event machinery.

The user-space library appears to remain

The beta 2 diff lists com.apple.iokit.EndpointSecuritySE as the only removed kernel extension. Its removed-dylib section contains one unrelated private framework and does not list libEndpointSecurity.dylib, indicating that Apple pulled the kernel component without clearing every Endpoint Security artifact from the operating-system image.

That partial removal matters. Apple may still be developing the feature on another branch, retaining the user-space interface while changing the kernel implementation, or postponing its inclusion in public beta builds. The firmware diff establishes the code change, not Apple's reason for making it.

Beta software frequently contains unfinished components that disappear before release. This case drew unusual attention because Endpoint Security is the foundation used by endpoint-detection vendors on the Mac, where it exposes system activity that ordinary applications cannot inspect. An iOS version, even one limited to Apple's research hardware, would give security researchers a new view into process execution, file access, debugging and task-port activity on the iPhone.

Apple's beta 2 removal cuts off that path in build 24B5089g. It does not establish that Endpoint Security has been abandoned for iOS. The first beta contained a working, deliberately restricted architecture with kernel hooks, entitlements and a client library. Apple built enough of the stack for researchers to map it, then removed its central kernel component in the next public build.