Apple Limits Bug Bounty Submissions After Flood of AI Slop

Apple has imposed a cap on the number of bug reports security researchers can submit to its bug bounty program due to an influx of fake bugs generated by artificial intelligence, according to The Financial Times. The tech giant reported a surge in low-quality submissions from amateur hackers who were utilizing AI tools to identify vulnerabilities.

Many of these submissions lacked genuine vulnerabilities, causing real ones to get lost in the overwhelming number of reports. A cybersecurity startup called Bynario discovered over 50 macOS bugs in just three weeks using ChatGPT, but was unable to report one of them to Apple because of the new submission limit. Bynario submitted eight reports in 2025 and five more in 2026 before hitting the restriction.

Bynario's founder described the current situation as a "very difficult time in the industry" as companies face a deluge of potential vulnerabilities. Apple has since been in communication with Bynario and is reviewing its submissions. Despite the new limit, researchers can still request an increase to ensure Apple's security team does not miss critical vulnerabilities.

While Apple primarily relies on human reviewers to assess reports, it has also started using AI to process submissions. AI has been instrumental in helping Apple identify numerous security flaws, with its iOS 26.6 update addressing nearly 90 vulnerabilities, some of which were discovered using Anthropic's Claude and OpenAI's Codex Security.

Apple's bug bounty program offers rewards of up to $2 million for exploit chains used in sophisticated attacks, with additional bonuses potentially increasing rewards to over $5 million. Tags: Bug Bounty, Vulnerabilities.