On September 2, Citizen Lab published a forensic report on a member of Serbia’s student pro-democracy protest movement, unnamed at their own request. The finding: “Our analysis confirmed that an iMessage zero-click exploit was used to infect the device with NSO Group’s Pegasus spyware.” High-confidence infection indicators run from December 2025 through January 2026. Then, in the same paragraph, Citizen Lab adds this: the exploit “has subsequently been patched by Apple as of iOS 18.4.1.”
I looked up when iOS 18.4.1 shipped. April 16, 2025, per Apple’s own security update page. That’s eight months before the infection window the same report describes. A patch cannot retroactively prevent an infection that predates it by most of a year, and Citizen Lab’s report does not explain the gap; it states the patch and the infection window as two separate facts and moves on. I don’t know which side of that gap is wrong, or whether both are right and I’m missing something about how forensic dating works. No CVE number accompanies the finding, so there’s no registry entry to check either claim against. That’s not a knock on Citizen Lab, whose forensic work here is careful and whose report says plainly what it does and doesn’t know elsewhere. It’s a data point about how much confidence a single paragraph of “this was patched” should earn once you notice nobody attached a number to it.
I went looking for this story because a reader asked about “Pegasus 2.0” and AI-driven threats to iPhones, and wanted to know what settings actually help. That’s a reasonable question built on an assumption that turns out not to survive contact with the primary sources. There is no Pegasus 2.0.
The term shows up in enough blog posts and explainer articles that it reads like a real product name, but it isn’t one anywhere I could find in forensic reporting. What is real, per Amnesty International’s Security Lab, working from internal NSO documents surfaced in the WhatsApp and Meta v. NSO Group litigation: NSO’s own engineering references version numbers like “Pegasus 2.50” and “Pegasus 3.0,” not a clean “2.0.” Individual infection vectors carry their own code names instead of a version bump: “Heaven,” the first zero-click installation vector for Android, approved for production around January 2018; “Diablo,” a zero-click vector against iOS 11.x’s Voice-over-WiFi implementation available the same year; “Dragonfly,” which targeted iMessage on iOS 12.x until Apple mitigated it in iOS 12.4.1; “Eden” and “Erised,” grouped with others under the umbrella name “Hummingbird” for WhatsApp-targeting capability. A dedicated internal unit, “White Services,” registers fresh email addresses, WhatsApp accounts, domains, and servers for every customer specifically so no piece of infrastructure gets reused long enough to become a fingerprint. That’s a rotation, not a release. There isn’t a version number that captures what makes Pegasus dangerous in 2026, because the product was never designed to need one.
The AI half of the question has a real answer, and it isn’t the one that would make a punchier headline. In May, Google’s Threat Intelligence Group reported: “For the first time, GTIG has identified a threat actor using a zero-day exploit that we believe was developed with AI.” The vulnerability was a two-factor-authentication bypass in a Python-based, open-source system-administration tool. Their confidence rests on the exploit code itself: “an abundance of educational docstrings, including a hallucinated CVSS score, and uses a structured, textbook Pythonic format highly characteristic of LLM training data.” That’s a documented case of an AI-assisted zero-day in the wild. It is not a phone.
The closest documented AI involvement in mobile spyware happens downstream of infection, after a device is already compromised. PROMPTSPY, an Android backdoor first identified by the security firm ESET, contains a module called “GeminiAutomationAgent” that calls the Gemini API to interpret what’s on screen and issue commands for autonomous device manipulation, including capturing biometric data to defeat authentication. That’s AI doing something new: acting as the malware’s hands after the device is already compromised. It says nothing about how the device got compromised in the first place. For that half of the question, the closest thing to evidence is an April writeup from the security firm iVerify, titled “How Leaked Exploit Chains Fueled the Age of AI-Accelerated iOS Attacks,” about two iOS exploit chains leaked earlier in the year. Read past the title, though, and the claim gets narrower: iVerify never says AI built those two leaked chains, which were human-built exploits first. What it actually argues is forward-looking, that combining current AI capability with the techniques those chains revealed “could make AI-assisted exploit development for iOS feasible” going forward. That’s a prediction about what becomes possible next, not a finding about what already happened. A researcher’s prediction is not the same claim as an observed fact, and the difference matters for exactly the practical reason my reader asked about it: the settings below are chosen to defend against what’s actually been documented, which is a narrower and more useful target than a title built to sound like it already has.
Which brings me to the one part of this that has an unusually clean answer. Apple told TechCrunch in March: “We are not aware of any successful mercenary spyware attacks against a Lockdown Mode-enabled Apple device.” That’s a vendor talking about its own product, so it’s worth discounting on priors alone. Except Amnesty International’s Donncha Ó Cearbhaill, whose job is specifically to find cases where vendor security claims fail, said something close to the same thing independently: he and colleagues “have not seen any evidence of an iPhone being successfully compromised by mercenary spyware where Lockdown Mode was enabled at the time of the attack.” Citizen Lab has documented at least two cases, involving both Pegasus and the Intellexa/ Predator spyware line, where Lockdown Mode actively blocked a live attack. Researchers have also found spyware samples built to detect Lockdown Mode and abort the infection attempt rather than risk leaving forensic traces behind, which is itself a strange kind of endorsement: the people building this software are routing around the setting rather than trying to beat it. None of that adds up to “unbreakable.” No lab has an exhaustive count of every attempt made against a Lockdown Mode device, successful or not. “No documented bypass” is the accurate claim; “impossible to bypass” overstates it. Even with that caveat, it’s still the single best-supported claim in this entire essay, better supported than the patch date Citizen Lab printed about its own case.
Turning it on costs functionality you’ll notice. On iPhone and iPad it’s under Settings > Privacy & Security > Lockdown Mode; on Mac, System Settings
Privacy & Security > Lockdown Mode. Once it’s on, most Messages attachments beyond certain images, video, and audio get blocked, link previews disappear, Safari drops complex web technologies including JIT compilation, FaceTime calls are blocked from anyone you haven’t called in the past 30 days, incoming invitations to shared albums or Apple services are blocked unless you sent one first, devices won’t auto-join open Wi-Fi or fall back to 2G/3G, and configuration profiles can’t be installed at all. That tradeoff is probably why the people who’ve actually turned it on skew toward those with a specific reason to think they’re a target.
For everyone else the lower-cost defenses do most of the practical work. Under Settings > General > Software Update > Automatic Updates, turning on “Security Responses & System Files” gets you Apple’s silent security patches without waiting on a full OS release cycle (Apple now calls this Background Security Improvements), and it’s the mechanism that would have closed something like CVE-2026-20700 the fastest: a dyld memory-corruption issue Apple’s own February advisory says “may have been exploited in an extremely sophisticated attack against specific targeted individuals,” patched same-day across iOS, iPadOS, macOS, tvOS, watchOS, and visionOS 26.3. Messages has its own filter, called Screen Unknown Senders as of iOS 26 (Filter Unknown Senders in older versions), under Settings > Apps > Messages
Unknown Senders. It won’t stop a zero-click exploit, but it moves messages from non-contacts into a tab that doesn’t notify you, cutting off the much larger volume of attacks that still need you to open something. On Mac, Gatekeeper and XProtect run by default and don’t need configuring; System Integrity Protection also runs by default and has no toggle in normal use at all, since turning it off requires booting into recovery mode deliberately. For most Mac users the practical guidance is simply to leave it alone; there’s no setting to go check.
None of this resolves the gap in Citizen Lab’s own timeline. What it does resolve is the question underneath my reader’s original one: which of the two scary stories, the version-numbered spyware or the AI that writes exploits, should change what you do with your phone tonight. Neither one, as far as the primary sources currently show. The setting that’s actually been tested, repeatedly, by people whose job is to break vendor security claims, is a switch in a menu most iPhone owners have never opened.
References