Magnet Forensics announced that its GrayKey forensic device can bypass Apple’s Inactivity Reboot, a security measure that restarts i Phones after 72 hours of inactivity. The discovery was made in early 2026 after researchers tested the tool against recent iOS 18.1 devices.
In iOS 18.1, Apple introduced Inactivity Reboot to limit the time a locked i Phone can remain untouched. When the device has not been unlocked for three days, it automatically restarts and temporarily disables the passcode lock. The feature was designed to reduce the risk of unauthorized access if a phone is lost or stolen. Magnet Forensics found that GrayKey can extract the device’s encryption key before the reboot completes, allowing the tool to unlock the phone regardless of the reboot.
GrayKey is a hardware appliance that connects to a phone’s Lightning port. It sends a series of low‑level commands that force the device to expose its secure enclave. By exploiting a timing window during the reboot process, the tool can capture the encryption key before the system clears it. Once the key is obtained, GrayKey can decrypt the phone’s data and bypass the passcode screen. The researchers confirmed the method on multiple i Phone 15 models running iOS 18.1 and later.
The technique relies on a combination of hardware manipulation and software exploits. Magnet Forensics’ team noted that the device’s firmware does not guard against the specific sequence of commands used by GrayKey. Because the reboot process is not fully locked down, the key extraction can occur even when the phone is not physically accessed. The bypass does not require the phone’s screen to be unlocked, making it a powerful forensic tool.
Is Apple’s security still reliable? The answer is mixed. While Inactivity Reboot was intended to protect users, the new bypass shows that determined attackers can still gain access. For law‑enforcement agencies, the ability to unlock phones after days of inactivity is a boon. For consumers, it raises concerns about the integrity of the passcode lock. Apple is likely to patch the flaw in the next iOS update, but the window of vulnerability remains until then.
The discovery also highlights the ongoing arms race between security vendors and forensic tools. GrayKey’s hardware approach is not limited to i Phones; similar techniques could target other encrypted devices. Users who value privacy should keep their software up to date and consider disabling features that could be exploited.
What is Inactivity Reboot? Inactivity Reboot is a feature introduced in iOS 18.1 that restarts an i Phone if it has not been unlocked for 72 hours. The reboot temporarily disables the passcode lock to reduce the risk of unauthorized access.
How does GrayKey bypass the reboot? GrayKey plugs into the Lightning port and sends a sequence of commands that forces the device to expose its secure enclave during the reboot. It captures the encryption key before the system clears it, allowing the phone to be unlocked.
Is my i Phone safe from this attack? If your device runs the latest iOS patch, the vulnerability should be closed. Updating your software regularly and keeping your passcode strong are the best defenses.