AI-assisted vulnerability reports surge, Apple limits the number of submissions from researchers.

According to the Financial Times, Apple’s internal security team has seen a surge in vulnerability reports as numerous researchers use AI models to hunt for software flaws, leading the company to limit the number of vulnerabilities researchers can submit simultaneously in June and impose a 30-day cooling-off period. Apple said some AI-generated reports fabricate security risks, straining its review system. Italian cybersecurity startup Bynario said it used OpenAI’s ChatGPT to uncover over 50 vulnerabilities in the latest MacBook operating system in three weeks, including a privilege escalation attack chain that could let attackers gain full control of Apple computers. However, due to Apple’s report submission limits, the firm was temporarily unable to file the relevant vulnerabilities. Apple said it has since reached out to Bynario and begun reviewing the findings. The company noted that every security report still requires manual verification, and it is also using AI internally to categorize the flood of submissions. Researchers can apply for higher submission quotas to ensure critical vulnerabilities reach the security team. Bynario estimates the privilege escalation flaw it discovered could be worth between $100,000 and $200,000 on the cybercriminal black market. Apple launched a new bug bounty program last year, offering up to $5 million for discovering the most severe and complex threat categories in its software. Apple’s system security update released this week also revealed that tools from Anthropic and OpenAI helped identify multiple device vulnerabilities, with the number of fixes this cycle roughly five times that of previous update periods. Security firm Sophos noted that AI is boosting the efficiency of real vulnerability discoveries while generating a large volume of low-quality reports, shifting the challenge for bug bounty programs from "finding flaws" to rapid verification, prioritization, and response.