Apple has equipped its bug bounty program Feedback Assistant since June 2026 with a cap on open reports and a 30-day embargo, after AI-generated reports had overwhelmed the security team. The capping also affected a genuine find: The Italian startup Bynario was initially unable to submit a severe macOS vulnerability with an estimated black market value of up to $200,000 because its quota was already exhausted.
Language models flood Apple’s review team with false reports
Large language models significantly lower the entry barrier for bug hunting: Those without deep system knowledge can still generate dozens of technically sounding reports in a short time. A large portion of these describes, according to the Financial Times, vulnerabilities that do not exist in this form – hallucinations dressed in technical jargon. Each individual report still requires human review before it is clear whether there is a real bug or just an AI artifact. The trend aligns with a significantly increased volume of AI-discovered vulnerabilities across the industry, which is increasingly pushing review teams to their capacity limits.
Apple responded with the capping in the internal reporting portal: a maximum number of simultaneously open reports per researcher and a 30-day embargo after reaching the limit. A higher quota can be unlocked upon request. Apple is not alone with this problem: The security provider Sophos also describes in its own blog post the shift in bug bounty programs – the challenge is shifting from filtering the flood to quickly verifying actual finds, as new models increasingly produce reproducible, real vulnerabilities. Sophos itself paid out around $600,000 in 2025 for nearly 1,350 confirmed submissions out of around 7,000 reports in total.
Bynario finds a real gap precisely during the embargo
The Italian security startup Bynario used ChatGPT to automate the search for vulnerabilities in macOS and identified, according to Digital Trends, more than 50 potential bugs within three weeks. One of them turned out to be a verifiable privilege escalation chain related to screen sharing and remote management via outdated VNC access, cataloged as CVE-2026-43760. An attacker could have gained full control over a Mac without the victim noticing anything.
Bynario CEO Alfredo Pesoli estimates the black market value of the gap at $100,000 to $200,000 – an assessment from the startup itself, independently unverified. However, Bynario was initially unable to report the find via Feedback Assistant because Apple’s new capping was already in effect and the quota for open reports was exhausted. Only after the reporting on the case did Apple reportedly reach out to the startup. Whether the gap has since been officially submitted, reviewed, and compensated is not yet known. The case illustrates the downside of the capping: A measure against false reports can also temporarily hinder genuine, urgent finds.
Apple itself relies on AI-supported bug hunting
While Apple limits the number of external AI reports, the company claims to use AI models for vulnerability searching in its own code: Recent security advisories attribute the discovery of a kernel vulnerability, among other things, to Anthropic’s Claude, while OpenAI’s Codex Security reportedly assisted with several WebKit bugs. The base bounty for the most severe zero-click exploit chains is $2 million, with bonus payments potentially exceeding a total of $5 million. Since the program’s launch, Apple claims to have paid out more than $35 million to over 800 researchers.
However, the sheer number of reported gaps growing does not automatically mean more attacks: A review by VulnCheck recently showed that only a fraction of the vulnerabilities found with AI tools are actually exploited. For Apple’s review team, the bottleneck remains distinguishing between the rare genuine finds and the growing mass of false reports.
It remains open whether other large bug bounty programs like those from Google or Microsoft will introduce similar caps once AI tools trigger comparable flood waves there. For security teams, the actual challenge is thus shifting from vulnerability searching to verification – a bottleneck that additional computing power alone does not resolve.
