On-device assistants, the local, low-latency AI features now shipping in phones and laptops, are widely pitched as a privacy-preserving alternative to cloud-only models. That promise rests on two assumptions: that sensitive credentials and tokens remain safely stored on the device, and that any server-side interactions are mediated by short-lived, device-bound session artifacts.
Those assumptions are being challenged. In April 2026 researchers published practical attacks that demonstrate cross-device token theft and replay against modern on-device assistant stacks, and security teams are now reevaluating whether current token lifecycles, storage practices and device bindings are sufficient. The technical and policy implications extend from mobile OS vendors to enterprise identity teams and cloud service operators.
Threat overview
Token-replay attacks occur when an attacker captures an authentication artifact,an access token or refresh token,and reuses it to impersonate the original device or user. The technique bypasses primary authentication factors because the token itself contains the session claims the service trusts. Token replay has been a known enterprise problem for several years, but the attack surface has widened as on-device assistants create new local tokens and hybrid flows between device and cloud.
Industry analysts and explainers emphasize that token replay is not a theoretical edge case: attackers can exploit weak storage, browser-based proxies, or man-in-the-middle (AiTM) infrastructures to harvest tokens and replay them elsewhere, often with little immediate detection. Short token lifetimes, token binding, and session revocation are repeatedly recommended mitigations to reduce impact and window of abuse.
Recent briefings from security vendors and incident-response teams report an uptick in token-theft incidents and post-exploitation replay attempts, where attackers use stolen session artifacts rather than stealing credentials directly. The rise of on-device AI features has created new integration points, SDKs, local caches, and private-cloud bridges, that broaden the set of places tokens can leak from.
How token-replay attacks work on device
At a high level an on-device assistant authenticates a user or device, receives a token (or set of tokens) from a cloud service, and uses those tokens to request privileged operations. If an attacker can extract those tokens, via a malicious extension, compromised application, or a vulnerability in the storage layer, they can attempt to reuse them from another endpoint to call the same APIs or request new tokens.
Two practical enablers make replay attacks effective: (1) tokens that are not cryptographically bound to strong device-specific secrets, and (2) long token lifetimes or refresh mechanisms that allow replay long after initial collection. Where tokens are stored in app sandboxes or synced across devices, the attack window expands. Attackers also chain token replay with account abuse techniques, like enrolling a new device or triggering silent OAuth grants to escalate access.
On-device assistants add complexity because they often combine local inference with cloud-backed services (for world knowledge, billing, or third-party skills). That hybrid architecture can produce multiple tokens with overlapping privileges, some tied to the local model, some to cloud services, increasing the number of artifacts an adversary might target.
Case study: Serpent and Apple Intelligence (April 2026)
On April 17, 2026, an academic team published a paper demonstrating a practical cross-device token-replay attack,called the Serpent attack,against Apple’s intelligence stack. The research shows how an attacker can extract access tokens from a compromised device and use them from another device while the original token owner remains rate-limited, effectively stealing privileged access without immediately alerting the victim.
The Serpent work is notable for its realism: it targets shipped components and uses techniques that are feasible at scale, rather than contrived laboratory exploits. The authors detail how hybrid on-device/cloud flows and insufficient device binding allowed replay across device boundaries, and they demonstrate real-world API abuse scenarios that mirror how assistants request user data and perform actions on behalf of the user.
Although the paper focuses on a particular vendor’s implementation, its technical lessons are broadly applicable: token handling, storage isolation, cryptographic binding to device keys, and end-to-end session design are systemic issues that affect any assistant that mixes local models with cloud services.
Why on-device models are attractive targets
On-device AI is now mainstream: major vendors ship local models or tightly integrated hybrid flows in mobile and desktop operating systems. Running inference near the user reduces latency and can improve privacy, but it also concentrates valuable tokens and privileged SDKs on the endpoint. Adversaries attacking end-user devices gain access not only to personal data but to the session artifacts that services trust.
Hardware and software diversity complicate defenders’ work. Some platforms use hardware-backed keystores or TPM-like modules to protect keys; others rely on OS-level encryption or application sandboxes that vary in robustness. Where token protection relies on optional platform features, the weakest link dictates risk for a given user population.
Finally, consumer devices are often less rigorously managed than corporate endpoints. That means a single compromised personal device can yield tokens that authenticate into enterprise services or cloud accounts, enabling lateral abuse that crosses consumer/enterprise boundaries.
Mitigations: device binding, token lifecycle, and telemetry
Defenses fall into three complementary areas. First, cryptographic token binding and proof-of-possession schemes tie tokens to a device-specific secret (for example, a TPM-stored key or session key) so a stolen token cannot be presented successfully from another host. Microsoft’s Primary Refresh Token (PRT) and token-protection work are practical examples of binding tokens to device session keys to limit replay.
Second, minimize windows of opportunity: shorten token lifetimes, require frequent reauthentication for high-risk operations, and avoid long-lived refresh flows unless they are themselves bound to hardware secrets. Enforce immediate revocation paths and telemetry hooks that allow services to invalidate sessions quickly when anomalous use is detected.
Third, increase visibility and control. Instrument assistant integrations so they emit telemetry when tokens are granted, refreshed, or used for privileged calls; correlate those events with device posture and user interaction; and apply conditional access that denies requests from untrusted or unmanaged endpoints. Platform vendors should treat assistant SDKs as first-class authentication clients with clear, documented requirements for token protection. Practical implementation guides and long-term mitigation strategies are available for teams updating their token management.
Operational and policy implications for vendors and enterprises
Vendors must assume attackers will attempt to extract tokens from endpoints and design APIs and SDKs accordingly. That means shipping default-safe configurations: hardware-backed storage, enforced token binding, and conservative token lifetimes out of the box. Failure to do so shifts the burden to enterprise operators and end users to harden environments that should already be secure by default.
Enterprises should inventory where assistant SDKs and on-device models are present in their estate, treat tokens used by those components as high-value artifacts, and apply the same conditional-access and device-compliance checks used for other critical services. Incident response playbooks must be updated to include token-replay detection and rapid token revocation as primary containment steps.
Regulators and standards bodies will also take interest: as on-device AI becomes integral to user workflows, the risk of cross-device impersonation has privacy and consumer-protection implications. Expect guidance and possibly minimum-security requirements around token binding, default encryption, and transparent telemetry for assistant features in regulated sectors.
Recommendations for technologists and policymakers
Short-term pragmatic steps: require token binding for any flow that issues long-lived grants; default to short-lived access tokens with auditable refresh; and instrument assistant-related tokens with clear scopes and logs. Product teams should publish secure integration guides and threat models for assistant SDKs.
Strategically, platforms should accelerate deployment of hardware-backed key attestation and provide mechanisms for servers to cryptographically verify device state before honoring token-based requests. Credential-less, phishing-resistant authentication (passkeys) and attested device identity are complementary controls that reduce token-based attack opportunities.
Policymakers and procurement teams should prioritize demonstrable cryptographic device binding and incident transparency when evaluating on-device assistant offerings. Procurement contracts can require security baselines and timely patching commitments to reduce exposure across the installed base.
In short: token-replay attacks are no longer a niche risk confined to enterprise SSO, they are an operational reality for any ecosystem that keeps session artifacts on consumer endpoints. Remedies exist, but they require joint action from OS vendors, cloud providers, enterprises and standards bodies to be effective at scale.
The arrival of practical cross-device replay research in April 2026 crystallizes a broader point: architectures that mix local AI with cloud services must treat session artifacts as first-class security objects. Absent widespread adoption of device-bound tokens and aggressive lifecycle controls, on-device assistants will remain a lucrative target for token-theft and replay.
