Apple's security vulnerability reporting system is overwhelmed by AI-generated submissions, forcing the company to cap researcher submissions and inadvertently blocking legitimate critical bugs from review.
Apple's bug bounty program faces a growing problem: AI-generated spam is clogging the review pipeline so severely that the company has implemented submission caps per researcher.
The consequences became apparent when Italian startup Bynario discovered a serious macOS vulnerability worth up to $200,000 on the black market but couldn't initially report it through official channels due to submission limits triggered by the influx of fabricated reports.
The situation highlights a broader challenge facing technology companies: as AI tools become more accessible, malicious actors and low-effort participants flood bug bounty programs with worthless submissions. Rather than dedicating resources to filtering submissions, Apple has chosen to restrict legitimate researchers' ability to report issues.
Bynario eventually found a way to report the vulnerability, but the delay raises questions about how many other genuine security issues might slip through the cracks or remain unreported entirely. Security researchers depend on bug bounty programs as a legitimate way to disclose vulnerabilities responsibly, earning rewards while helping companies patch flaws before malicious actors exploit them.
The submission caps create a perverse incentive structure. Legitimate researchers face barriers to reporting, while the underlying AI spam problem remains unaddressed. This could push security researchers toward alternative disclosure channels or encourage them to sell vulnerabilities on the black market—the opposite of what responsible disclosure programs aim to achieve.
Apple's approach mirrors challenges other major tech companies face as they scale security operations. Google, Microsoft, and others have all experienced similar issues with low-quality submissions overwhelming their systems. However, simply capping submissions rather than improving filtering mechanisms may prove counterproductive in the long term.
The incident underscores the need for smarter intake systems that can distinguish between legitimate research and automated spam, rather than blanket restrictions that harm the security research community Apple ultimately depends on.
The North Carolina Ports Authority confirmed a cyberattack has disrupted IT systems across its major operations. The attack affects Port of Wilmington, Port of Morehead City, and Charlotte Inland Port.
Security researchers have identified a Chinese-linked spyware operation targeting victims across 13 countries, including the United States. The discovery came after operators made a critical operational security mistake.
Artificial intelligence has revealed a long-overlooked browser security vulnerability that enterprises can no longer afford to ignore. Skyhigh Security explains why browsers have become essential control points for managing data, AI interactions, and modern work environments.