Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs

Apple has moved to address a security flaw in its Hide My Email service that enabled users' real email addresses to be unmasked, effectively undermining the feature's privacy guarantees. 404 Media reported Tuesday that a fix for the issue was deployed by Apple on July 3, 2026, after more than a year, when it was disclosed to the company by Tyler Murphy, co-founder of EasyOptOuts. Hide My Email

The article reports that Apple has fixed a long-standing flaw in its Hide My Email service that could expose users’ real email addresses in mail server logs when messages to an alias bounced, as confirmed by 404 Media and follow-on testing.[3][4] This issue, originally disclosed by researcher Tyler Murphy in 2025, undermined the privacy guarantees of the aliasing feature until Apple deployed a working patch on July 3, 2026.[1][3][4] From a RealGround perspective, this illustrates a classic data leakage and supply-chain-style risk where a privacy control (email aliasing) silently failed for over a year, leaving sensitive identifiers in third-party infrastructure and logs.[3][4] Organizations integrating third-party communication, identity, or privacy features into AI agents should treat them as part of the AI supply chain, require SBOM-level visibility and security assurances, and plan for residual data exposure in external logs even after a vendor issues a fix.