Apple has changed its bug bounty program after security teams received a sharp rise in low-quality reports generated with artificial intelligence tools. The company now limits how many vulnerability reports researchers can keep open and requires a 30-day cooling-off period before they submit more.
The Financial Times reports that Apple introduced the new rules in June as AI models made it easier to scan software, combine flaws, and generate large numbers of reports. Many submissions include weak evidence or describe vulnerabilities that do not exist, which slows reviews and delays work on genuine security issues.
Don’t miss the best of The Mac Observer
Set us as a preferred source and our Apple reporting ranks higher in your Google Search results and Discover feed — one tap, no account changes.
Researchers can request a higher submission quota when they find serious flaws, although the limit has already caused problems. Italian security startup Bynario said Apple blocked further submissions after the team reported several bugs, including a macOS exploit chain that could give an attacker full control of a Mac.
Apple later contacted Bynario and began reviewing its findings. The company said the quota system helps its security teams manage the growing volume of AI-generated reports while allowing trusted researchers to request more capacity.
Apple also uses AI tools from companies including OpenAI and Anthropic to find vulnerabilities. Recent software updates credited several researchers who used AI models, showing how the same technology now helps discover real flaws while also flooding bug bounty programs with unreliable reports.
Discussion