Apple has imposed limits on how many bug reports a security researcher can keep open simultaneously, following a flood of AI-generated submissions that describe nonexistent vulnerabilities. The restriction has already had a tangible cost: a genuine exploit went unreported.

According to the Financial Times, Apple's security team was overwhelmed by submissions produced with AI tools that fabricate flaws. In response, Apple moved in June to introduce a cap and a 30-day cool-off period on its security portal, requiring researchers to apply for a larger reporting quota.

The cap prevented Milan-based cybersecurity startup Bynario from submitting a critical finding. Bynario told the FT it had used OpenAI's ChatGPT to identify more than 50 bugs in the latest version of macOS within a three-week period. One of these was a privilege escalation exploit chain—a category of vulnerability that grants an attacker unrestricted control over a machine, and a mainstay of serious macOS attacks given the operating system's footprint of more than 100 million active users.

Bynario was unable to file the report because Apple had already rejected further submissions from the firm. Chief Executive Alfredo Pesoli estimated the exploit's value on the criminal market at $100,000 to $200,000 and stated that "maintainers and vendors have been flooded by the sheer amount of bugs" being uncovered.

Apple confirmed to the FT that it is now in contact with Bynario and reviewing the firm's work.

Apple said it had "recently adjusted the number of new reports a researcher can have open at once," and noted that researchers can request a higher limit at any time. Every alleged vulnerability still requires human confirmation, though Apple is reportedly using AI internally to triage the volume of incoming reports.

The same category of tools has also been working in Apple's favor. In security updates released last week, Apple credited Anthropic and OpenAI software with helping surface flaws, carrying roughly five times the number of fixes typical of a normal cycle, according to the FT. (9to5Mac also reported on the AI credits.)

A "Submission Flood"

The surge in AI-assisted bug reporting has grown markedly in recent months. In May, security firm Bugcrowd—whose clients include OpenAI—reported that submissions through its platform more than quadrupled over a three-week period in March, with the majority being fabricated.

HackerOne and Nextcloud suspended their paid programs in April. Nextcloud announced on its HackerOne page that no rewards would be paid "regardless of severity" until it could implement filtering for low-effort reports.

The volume is driven in part by the financial rewards available. Meta, Microsoft, Apple, and Crypto.com collectively paid out at least $58 million in 2025, while Apple's own top-tier bounty reaches $5 million for a single finding—a ceiling Apple set in 2020 when it expanded the program it first launched in 2016.

Simultaneously, large language models are becoming increasingly proficient at identifying real vulnerabilities. In March, Anthropic introduced Mythos, a cybersecurity-focused model initially restricted to select technology companies, banks, and researchers under Project Glasswing. Mozilla stated that the model surfaced 271 vulnerabilities in Firefox during internal testing.

In May, Vietnam-based security startup Calif reported that it had used a preview version of Mythos to build the first public macOS kernel memory corruption exploit capable of surviving Memory Integrity Enforcement—the defense Apple announced last September as the largest memory safety upgrade in the history of consumer operating systems. Calif identified the bugs on April 25 and had a working exploit by May 1.

Rather than submitting through Apple's portal, Calif delivered the exploit in person at Apple's California headquarters, citing a desire to avoid "getting buried in the submission flood" that had affected participants in the hacking contest Pwn2Own. Three months later, Bynario attempted to use the portal and was unable to gain access.

AI-Driven Crypto Threats

AI is also being used to engineer exploits targeting cryptocurrency infrastructure. Coinkite, manufacturer of the Coldcard hardware wallet, has suggested that AI was likely used to identify a bug in its open-source firmware that had gone unnoticed for five years, enabling attackers to steal more than $100 million. (Hardware wallet firms have also warned of a phishing surge as losses mounted.)

The Coldcard disclosure came two months after Zcash revealed that researcher Taylor Hornby, working with Claude Opus 4.8, had identified two lines of code in its Orchard shielded pool that allowed undetectable counterfeiting of ZEC for four years. The privacy coin subsequently rolled out the Ironwood upgrade to address the vulnerability.