Apple and Bynario agree GPT-5.5 found a real macOS bug. They disagree on the report cap.

Apple has implemented new policies limiting the number of security reports researchers can submit simultaneously to its internal portal. This comes after a surge in AI-generated reports, many of which turned out to be false positives. Italian cybersecurity firm Bynario utilized GPT-5.5 to uncover over 50 potential bugs in Apple's latest macOS version within three weeks, including a vulnerability in macOS Screen Sharing that could enable unauthorized data access and root-level file creation.

However, Bynario was unable to report this flaw initially due to hitting Apple's open investigation limit. Apple subsequently reached out to Bynario to reassess its submissions. Despite AI's assistance in researching vulnerabilities, the submitted reports still need verification through a manual review process. This issue echoes a similar problem across the industry, where AI-driven security tools automate various tasks, causing a backlog of reports that are difficult for security teams to address.

Both Apple and HackerOne have adopted AI to triage incoming vulnerability reports, but the technology struggles to distinguish between genuine and fabricated flaws. Apple requires researchers to provide specific details about affected software, reproduction steps, and proof of concept to validate a report. Failure to submit valid reports could result in temporary or permanent removal from the program.

While AI can help researchers uncover potential vulnerabilities, the current system risks overlooking genuine threats due to a bottleneck in the triage process.