Apple’s security updates have long been a black box. CVE advisories are published monthly, but the actual binary changes that fix them remain buried inside massive IPSW firmware images. This talk shows how we can finally open that box—turning vague blurbs into concrete, binary-level truth through automation and agentic reasoning. Building on last year’s manual patch-diffing techniques, this year’s talk introduces a hybrid system where deterministic tools anchor the facts and agents connect the dots. By combining curated CVE data, IPSW firmware extraction, and function-level diffs with LLM-powered correlation and explanation, we can systematically dismantle Apple’s updates and surface their real security fixes. We’ll walk through a reproducible pipeline using `ipsw diff` and `ghidriff` to extract and compare binaries, while DSPy and ReAct agents reason over the changes to map CVEs, explain mitigations, and classify vulnerabilities. The result: structured vulnerability reports generated within hours of release. Case studies include: - **CVE-2025-43400** — FontParser out-of-bounds write - triaged within hours of public disclosure - **CVE-2025-31325** — CoreAudio double-free - requiring frontier model context engineering - **CVE-2025-31201** — RPAC - showcasing diffing as a tool for feature research - **CVE-2025-43200** — Messages logic error - highlighting agentic reasoning under uncertainty Whether you’re a reverse engineer, vulnerability researcher, or just curious what Apple really fixes each month, this talk is for you. Through live demos and case studies we’ll show how this approach transforms Apple’s opaque updates into transparent, actionable intelligence. Stop guessing what changed in each Apple Security Update start knowing, with automation and agents working together.