GoKawiilApple limits bug bounty submissions per researcher amid AI-generated report surge
Apple has confirmed it quietly implemented a cap on how many open vulnerability reports researchers can submit through its security portal, paired with a 30-day cooldown once that limit is hit. The company says the move addresses a flood of AI-generated bug reports overwhelming its review process, a challenge it frames as industry-wide. A Financial Times report notes small security firms like the seven-person Bynario have been caught by the new limits despite submitting only a handful of legitimate bugs this year.
GoKawiil's interpretation of the reporting above, not reported fact.
Throttling submissions risks penalizing small, legitimate research teams alongside spam generated by AI tools, potentially discouraging genuine vulnerability disclosure at a time when AI is also making it easier to find real security flaws faster than ever. If Apple's filtering mechanism can't distinguish quality reports from noise, it may end up suppressing the very research that keeps its ecosystem secure.
- Apple capped bug bounty submissions with a 30-day cooldown after hitting the limit.
- The policy responds to a surge in AI-generated vulnerability reports overwhelming reviewers.
- Small research firms like Bynario report being blocked despite submitting few, legitimate bugs.
YubiKey 5C NFC Security Key — If security is on your mind after reading about vulnerability reporting and AI-driven threats, a hardware security key is the single easiest upgrade for your own accounts. The YubiKey 5C NFC works with Apple IDs and countless services, plugging into USB-C or tapping against an iPhone for phishing-resistant sign-ins.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: 9to5mac.com — Bradley C, 2026-09-05
Published there as: “Apple @ Work: Capping bug bounty submissions is the wrong response in the AI era of security threats”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.