In one 24-hour window this week, Apple Silicon went from being a credible home for always-on, fully offline AI agents to being the platform where Apple’s own iCloud Private Relay is silently handing websites the user’s real IP address. The two stories are not just adjacent. Together, they answer - honestly, for once - the question local-AI users keep asking: can a Mac really be the private AI box people want it to be?
Liquid AI lands on Mac via MacPaw and Setapp
On August 5, TechCrunch reported that MacPaw, the Ukraine-based parent of the Setapp subscription app store, will offer developers an on-device inference system called Elix that bundles Liquid AI’s models with a local memory layer where persistent state stays on the device. The same platform will also offer cloud access to other providers, including Google. Setapp has more than 150,000 paying users today, and MacPaw plans to expose the same inference layer to third-party developers who ship through its store.
The first consumer product is a locally hosted version of MacPaw’s existing Eney AI assistant, which the company unveiled last year. Liquid AI co-founder and CEO Ramin Hasani explained the approach in language the local-AI community will recognize: “Before training our models, we select an architecture that is different and tailored to the hardware.” A second Hasani line points at the real product differentiator over Apple’s own on-device models: “We are also building a customization stack around models. This means that with user input, the models can use the data and improve.”
The monetization design is worth noting: MacPaw is testing a credit-based pricing layer in Setapp, where each AI operation burns credits based on task complexity. That keeps the on-device inference free of per-request cloud fees while still letting MacPaw meter heavy workloads.
LFM2.5-2.6B: small, fast, honest about its limits
The model that MacPaw will lean on is the one Liquid AI released the same week. Liquid AI’s own writeup and the matching Hugging Face blog post cover the same release: LFM2.5-2.6B, a 2.6 billion-parameter hybrid (22 double-gated short convolution blocks plus 8 grouped-query attention layers), 128K context, pre-trained on roughly 34 trillion tokens, with a post-training pipeline built for agentic workloads.
The numbers that matter for a Mac buyer: under 2.5 GB of memory at inference, 220 tokens per second decode on an Apple M5 Max, 113 tok/s on an AMD Ryzen AI Max+ 395, and 30 tok/s on a phone. Day-one support across llama.cpp, MLX, vLLM, SGLang, and ONNX means the same weights run on raw llama.cpp and on Apple’s MLX stack without conversion; Ollama and LM Studio both consume the llama.cpp build of the same weights.
The honesty in the release is unusual and worth flagging. The model card on Hugging Face says LFM2.5-2.6B is “not recommended for agentic coding and knowledge-heavy tasks.” The same post puts it bluntly: “Coding is the one place the larger models keep a clear lead, so reach for something bigger there.” That is the opposite of the breathless 3B-beats-GPT-4 framing that has come to dominate small-model marketing, and it is the kind of caveat a local-AI buyer can actually act on.
The model is released under Liquid AI’s own “lfm1.0” license - permissive for most local-AI use, but it is not Apache or MIT, so commercial integrators will want to read it.
Apple’s Private Relay is leaking real IPs through passkeys
On August 5, 404 Media reported a bug in iCloud Private Relay that defeats the feature’s main reason to exist: any website that supports - or merely claims to support - WebAuthn passkeys can read the user’s real IP address, even with Private Relay toggled on. Researchers Tommy Mysk and Talal Haj Bakry built a public test page at leaks.psylo.app to demonstrate the leak; 404 Media confirmed it independently.
The root cause is structural rather than a Safari bug that can be patched quickly. Passkey requests are issued by the operating system’s credential service, not by Safari, so they never enter Private Relay’s proxied path. Mysk described the impact without softening it: “any website that supports, or pretends to support, passkeys can see the user’s real IP address despite having iCloud Private Relay on.” OnionBrowser developer Mike Tigas, quoted in the same piece, called two of the leaks “entirely based on how iOS and WebKit work and solely in Apple’s hands” and called that “the part that’s kind of dire.”
Apple told 404 Media only that it is “investigating the researchers’ report.” There is no published workaround, no patch timeline, and no acknowledgment that the leak breaks a privacy guarantee Apple has been marketing as a paid iCloud+ feature for years. The bug also affects every browser on the platform - Chrome, Firefox, Brave, OnionBrowser - because iOS forces them all through WebKit.
This is the second Apple privacy-marketed default to regress in months. 404 Media’s previous reporting documented a Hide My Email bug that Apple knew about for more than a year before fixing.
What This Means
For anyone building a local-AI workflow on a Mac, the Liquid AI and MacPaw news is genuinely useful: there is now a credible commercial channel for shipping on-device agents to a paying user base, and there is a 2.6B-parameter base model designed for that role with clear documentation of what it is not good at. The two facts together lower the cost of building a “runs on your laptop, never phones home” assistant far below where it sat even six months ago.
The Private Relay leak complicates the privacy narrative on the same hardware. A Mac user who bought iCloud+ specifically to stop IP-based tracking, and who is now running an on-device Liquid AI model whose entire appeal is that no data leaves the device, is still leaking their real IP to every site they visit if it offers passkey login. The work-around is the same one users were told a year ago they no longer needed: a real VPN, layered in front of WebKit. For people who chose Apple hardware because of the privacy posture, this is the second time in recent months the posture has been quietly walked back, after the Hide My Email fix.
The combined effect is a clearer, less comfortable picture: the Apple Silicon local-AI ecosystem is real and improving quickly; the Apple privacy guarantees on the same machine are regressing at the same rate.
The Bottom Line
If you wanted Mac to be the platform where private AI runs locally, this week delivered a real local-AI milestone (Liquid AI’s 2.6B model + MacPaw’s Setapp distribution) and a real privacy regression (Private Relay’s WebAuthn leak) in the same 24 hours. Treat them as one story.