The three AI tiers
AI never decides something is wrong — it only explains verified facts. Explanations escalate from an on-device model, to Private Cloud Compute, to paid cloud triage, in that order.
AI explains, it never detects
The AI in Anomalous never decides that a process is a problem. That decision belongs to the detector, which does the math on CPU, memory, wakeups, and disk. The AI's only job is to turn the detector's verified facts into a short, calm explanation you can read: what the process is, why it is probably hot, whether that is normal for it, and the safest thing to do.
This split is the whole safety story. The explainer is fenced in by facts it is not allowed to contradict or invent around. It quotes the numbers the detector already measured; it does not re-run the judgment. Every explanation, no matter which tier produces it, fills the same diagnosis card so you see one consistent result.
Under the hood
The model instructions are explicit: "The DETECTOR has already judged this behavior anomalous — you explain it; you never re-detect or overrule the numbers" (JudgmentEngine.swift, instructions()). Before the model is consulted, a pure route() function writes fixed deterministic cards, with no AI, for three cases where the answer is always the same: an overheating kernel_task (thermal), a frozen "Not Responding" app (force-quit), and a genuine mystery daemon with no known identity and no bundle id. The bundle id is called out in code as "the hard fact that prevents hallucination."
Tier 1: on-device Foundation Models
The first tier runs entirely on your Mac using Apple Intelligence and Apple's on-device Foundation Models (macOS 26 or later). It is free, needs no network, and nothing about your machine leaves it. This tier handles the overwhelming majority of cards.
The model works as a tool-calling session. It can look up the exact numbers and the curated identity of a process, then quote those facts verbatim in the card. It is instructed never to invent an identity, a version, or a "known issue." If the on-device model is rate-limited or unavailable, the card degrades honestly to a deterministic card built from the knowledge map, rather than guessing.
Under the hood
Tier 1 uses SystemLanguageModel.default as a LanguageModelSession (JudgmentEngine.judge). The model may call four read-only tools — processHistory, baseline, correlated, and corpusEntry — each returning one short sentence with numbers inline. As the formatter notes, "the model QUOTES these values — it never recomputes or invents them" (JudgmentTools.swift). Instructions, tool schemas, and card schema are measured against the model's real context window and tools are dropped before the grounding facts are ever trimmed (fitToBudget).
Tier 2: Private Cloud Compute
The second tier is Apple's Private Cloud Compute (PCC) — a heavier "deep reasoning" pass that runs on Apple silicon servers under Apple's privacy guarantees. It is designed to upgrade only a weak first-tier card: low confidence, an unknown process, or an "explain only" verdict. The first-tier card is already on screen; the upgrade is non-blocking.
This tier is built and wired but off today. It requires an Apple entitlement the app does not yet hold, so the code refuses to run it. When the entitlement is granted, PCC activates with no code change. Until then, no request goes to Apple's servers through this path.
Under the hood
Tier 2 uses PrivateCloudComputeLanguageModel with ContextOptions(reasoningLevel: .deep), a 15-second timeout, gated on EscalationPolicy.shouldUpgradeToPCC. It is entitlement-gated on com.apple.developer.private-cloud-compute, checked via SecTask in hasPrivateCloudComputeEntitlement. The team measured that Apple's availability API falsely reports .available for unentitled processes and the first respond() then fatal-crashes, so the explicit entitlement check — not the availability API — is the real gate.
Tier 3: cloud triage (Get Help)
The third tier is a paid backend service, surfaced as a Get help button on the card. It is the deepest research tier, for novel problems, and it is the only tier that ever sends data off your Mac. It never fires automatically — money moves only on an explicit tap by a signed-in user.
When you tap Get help, the app composes a deliberately narrow, anonymized referral and sends it to the server. A reasoning agent writes a diagnosis grounded in a curated known-issues database and returns cited evidence links. A triage costs a flat 50¢; a repeat of the same kind of problem is served from a shared cache for 10¢, with the difference refunded, and if no real diagnosis can be produced you are refunded in full. Prepaid credits and pricing are covered on your account page.
Under the hood
The tap POSTs an allowlisted payload to /api/v1/triage (EscalationClient.escalate). The server agent uses the Anthropic provider (Claude) via the Laravel AI SDK and grounds specific claims through a curated LookupKnownIssues tool; with no hit it must say "no known issue on file" and give safe generic advice (TriageAgent.php). Because results are cached and shared across users keyed on the condition, the untrusted summary is framed as data-not-instructions and the model output is clamped before reuse (ProcessTriageJob.php, sanitizeDiagnosis). Pricing lives in TriageController.php (MIN_BALANCE_CENTS=50) and ProcessTriageJob.php (CACHE_COST_CENTS=10).
Privacy across the tiers
Privacy differs by tier, and the differences are deliberate:
- Tier 1 (on-device): fully local. Process facts never leave your Mac.
- Tier 2 (Private Cloud Compute): not active today. If ever enabled, it would use Apple's stateless, attested server privacy model.
- Tier 3 (Get help): the only tier that sends data off-device, and only on your explicit tap. What leaves is minimized by construction to allowlisted fields — bundle id, app and OS versions, hardware class, anomaly type, install source, a prose summary, and CPU and memory metric curves.
Raw process listings, full file paths, command lines (which can carry credentials), and usernames have no code path into the payload. Every send is recorded byte-for-byte on your device and mirrored on the server, so you can verify exactly what was transmitted. For the full posture, see what Anomalous sends and never sends.
Under the hood
The outgoing summary is assembled only from allowlisted safe fields in PayloadComposer.compose() — "there is no code path by which a file path, argument, username, or command line could reach it." Every escalation is written to the on-device SendLog (flow: .triage) before it is sent, and the bearer token is never sent in cleartext to a non-loopback host (assertSecureTransport). The sensor is open source at anomalous-mac, and the public data corpus is at anomalous-corpus — PRs welcome (the corpus repo may still be private today).