For years, the running joke about Siri was that it couldn't do the one thing people most wanted an assistant to do: actually be smart. So when a developer posted a video showing Anthropic's Claude answering from inside Siri's own menu on a Mac — setting reminders, generating files, behaving like a genuinely capable assistant — it understandably set off a wave of excitement.

But the demo is more interesting, and more complicated, than "Siri finally got good." It's a reverse-engineered look at plumbing Apple built but hasn't opened, and it quietly exposes a security question that matters far more than which chatbot answers your questions.

What actually happened

In mid-September 2026, developer "pdfu" demonstrated Claude running as a Siri extension on macOS Golden Gate — macOS 27 — using Apple's private Model Delegation API, on a developer beta build. In the videos, Claude appears as a Siri extension through the same underlying flow as Apple's built-in ChatGPT extension, showing up in Siri's "Ask…" menu. Two examples made the rounds:

  • A reminder. Asked to set a reminder, Claude interprets the natural-language request and relays it back to Siri, which creates the item in Reminders.
  • A file Siri can't make. In another example, Claude is asked to create a CSV file and returns it inside the Siri interface — something Siri cannot do on its own.

Visually it's seamless. Responses carry a Claude label but otherwise use the standard Siri presentation.

How the prototype is wired together

The clever part is the division of labor. This is not Claude taking over your Mac — it's Claude being handed a narrow job.

The mechanism is almost disarmingly simple on the surface: a local background program runs on the Mac, Siri forwards the request to it, that program calls Claude's command-line tool, and the result travels back the same way. Claude then streams text, files, and suggestions into Siri's interface.

Underneath, though, it leans on something not meant for public use. The discovery shows how a sandboxed third-party extension gets treated as a native AI provider inside Siri, using an internal Model Delegation API tucked inside Apple's App Intents framework. Crucially, the mechanism requires Apple's private com.apple.developer.model-delegation entitlement — authorization normally reserved for Apple's own uses rather than a general developer option.

The design draws a clean line: Claude handles the generative work while Siri remains responsible for native system actions. Claude can understand that you want a reminder set, but it can't reach into Reminders itself — it hands the organised request back to Siri, and Siri calls App Intents. One commenter's summary captured the shift neatly: Siri has gone from being a single model to being a power socket that different models can plug into.

The second, more aggressive mechanism

The reminder demo is the tame one. The same investigation turned up a second path that goes much further.

A separate protocol in "Model Manager Services" appears to allow Apple's entire server-side Siri model to be swapped out for another model, such as OpenAI's GPT-5.6 Terra. This isn't Siri asking an outside assistant for help — it's Siri's own brain being replaced. In that configuration, the replacement model receives Apple's native Siri planner prompt and tool definitions, allowing it to call Siri tools, request system actions, and work with the results those tools return — including personal data.

That distinction — delegation versus full replacement — is the heart of both the promise and the risk.

The limitations: this is not a feature you can turn on

Before anyone goes looking in Settings, the hard truth: there is no switch. Claude is not available as a user-facing option, and Apple has not opened the Model Delegation entitlement to third-party developers.

  • It's private API, not a product. This is a separate, private-API experiment, distinct from Apple's official Siri architecture built around Apple Foundation Models and Private Cloud Compute.
  • No supported install path. The demonstration shows what an authorised private integration can do; it does not provide a supported installation path for users or a public developer API.
  • Don't read it as an iPhone feature. iOS 27 carries comparable private hooks, but the Mac demonstration shouldn't be presented as a public iPhone feature.
  • Still beta scaffolding. The frameworks surfaced in developer betas and could change, break, or disappear before any public release.

In other words: it proves the pipes exist. It does not mean water is flowing to your house.

The security trade-offs

This is where the experiment earns real attention, and where the two mechanisms diverge sharply.

The delegation model is relatively contained. By design, the keys stay with Apple — Contacts, Reminders, launching apps, device permissions all remain Siri's to actuate. Claude gets the question and context and returns a suggestion; it never holds the authority to act. That's a sensible security posture: the capable-but-untrusted model proposes, and the trusted system component disposes. Even here, though, you're routing your spoken requests and surrounding context to a third-party model, which is a privacy consideration in its own right.

The full model-swap path is a different story. Handing an external model Siri's planner prompt, its tool definitions, the ability to request system actions, and access to personal data collapses that safety boundary. Whatever model sits in that seat effectively inherits Siri's reach into your device and your information. The trust you place in Apple's own Siri model would transfer wholesale to an outside provider.

And there's the method itself. This demo works by using a private entitlement outside its intended scope. Any unofficial setup that depends on undocumented frameworks and background programs relaying requests is, by definition, operating outside Apple's security review. That's fine for a researcher's demo on a test machine; it's not something to replicate on a Mac holding real data.

Why this experiment resonates

The reason this landed so hard isn't purely technical — it's history. According to Bloomberg's Mark Gurman, Apple was ready to rebuild Siri around Claude, but the deal fell through, reportedly because Anthropic wanted too much money, and Apple ultimately moved toward Google's Gemini. Internally, the irony runs deeper still: Apple reportedly runs heavily on Anthropic for product development and internal tools, with Claude running on in-house servers.

So a demo showing Claude sitting inside Siri's menu reads almost like an alternate timeline made briefly visible — the Siri that might have been, surfaced through code Apple left in the system. Gurman has also reported that iOS 27 is planned to let users choose among Claude, Gemini, and ChatGPT for Siri, which is likely why Apple built this delegation scaffolding in the first place.

The verdict

What the experiment proves is narrow but real: Apple engineered Siri to act as a host for third-party models, and that architecture is functional enough today that a determined developer can route Claude through it on a Mac. The reminder-and-CSV demo is a genuine glimpse of a more modular Siri.

What it does not prove is that this is something you can — or should — set up yourself. It relies on private entitlements, offers no supported path, and in its most dramatic form would hand an outside model the keys to your personal data and system actions. The sensible reading is to treat it as a preview of where Apple may be heading, not an invitation to wire it up on a machine you care about.

Siri as a socket, with Claude or others plugging in, may well be the future. For now, it's a demo — impressive, instructive, and best watched from a safe distance.

Details reflect developer demonstrations and reporting on macOS 27 / iOS 27 beta builds as of September 2026. Private frameworks in beta software can change or be removed before public release; nothing described here is a supported or user-accessible feature.