Apple Limits Bug Reports Amid AI Submission Surge

Summary

• Apple has restricted the number of active bug reports a researcher can submit due to a surge in AI-generated reports.
• Bynario, a cybersecurity startup, claims to have found over 50 vulnerabilities in macOS, including one that could grant full control of a device.
• This week's updates from Apple featured about five times more fixes than usual.

In response to a significant rise in AI-generated bug reports fabricating vulnerabilities, Apple has implemented a cap on the number of active submissions a researcher can maintain, as highlighted by the Financial Times.

This new policy led to the loss of a genuine exploit discovery. Bynario, based in Milan, reported that it utilized OpenAI's ChatGPT to identify over 50 weaknesses in the latest macOS version within a short span. Among these findings was a serious privilege escalation vulnerability that could potentially allow unauthorized access to a Mac.

However, due to the newly enforced limits, Bynario was unable to report this exploit. CEO Alfredo Pesoli estimated its potential market value between $100,000 and $200,000, noting that the influx of reports has overwhelmed maintainers and vendors. Apple has stated that it is in discussions with Bynario to assess their findings.

In June, Apple introduced restrictions that included a 30-day waiting period for submissions on its security portal, requiring researchers to request higher limits if necessary. While all reported issues still require human verification, Apple is also employing AI to manage report volumes. The company confirmed it has adjusted the number of new reports a researcher can keep open, allowing for requests for increased limits at any time.

AI tools have also proven beneficial for Apple, which credited software from Anthropic and OpenAI for aiding in the identification of flaws, resulting in an unprecedented number of fixes in recent updates, according to the FT.

The Challenge of Submission Floods

The issue of AI-generated bug reports has escalated in recent months. Bugcrowd reported in May that submissions through its platform had skyrocketed more than fourfold in March, with many being fraudulent. In response, platforms like HackerOne and Nextcloud paused their paid programs, stating they would not issue rewards until they could better filter low-quality reports.

This surge is fueled by the substantial rewards offered by tech giants, with Meta, Microsoft, Apple, and Crypto.com collectively providing over $58 million in bounty rewards in 2025, and Apple alone offering up to $5 million for a single major finding.

At the same time, large language models (LLMs) are becoming adept at identifying vulnerabilities. In March, Anthropic introduced Mythos, a cybersecurity-focused model available initially to select tech firms and researchers under Project Glasswing. Mozilla also reported identifying 271 weaknesses in Firefox during internal assessments.

In May, the Vietnamese firm Calif announced it had used an AI model to create a public macOS kernel memory corruption exploit, which bypassed a significant security feature introduced by Apple. Rather than submitting their findings through the portal, Calif opted to present their exploit directly at Apple's headquarters to avoid getting lost in the submission flood.

AI's Role in Crypto Vulnerabilities

AI's impact extends beyond bug identification to exploit creation in the cryptocurrency realm. Coinkite, the maker of Coldcard wallets, suggested that AI may have been used to uncover a long-standing bug in its firmware, which allowed attackers to steal over $100 million from its hardware wallets.

This follows a recent revelation from Zcash, where researcher Taylor Hornby, in collaboration with Claude Opus 4.8, discovered code flaws that enabled counterfeiting of ZEC for four years. This prompted Zcash to implement the Ironwood upgrade to fix the vulnerability.

Daily Debrief Newsletter