Apple Caps Bug Bounty Submissions as AI-Generated Fake Reports Flood System

Executive Briefing

• Limits imposed after amateur researchers used AI to generate hallucinated vulnerability reports, burying legitimate submissions.
• Startup Bynario discovered 50+ real macOS bugs via ChatGPT but hit Apple's submission cap before reporting a critical exploit.
• Researchers can request cap increases to ensure Apple's security team reviews genuinely critical vulnerabilities.
• Apple now uses AI itself to parse submissions; iOS 26.6 fixes ~90 vulnerabilities, some credited to Claude and OpenAI Codex.
• Bug bounty rewards reach up to $2M per exploit chain, with bonuses potentially exceeding $5M for high-severity finds.