GoKawiilApple @ Work is exclusively brought to you by Mosyle, the only Apple Unified Platform. Mosyle is the only solution that integrates in a single professional grade platform all the solutions necessary to seamlessly and automatically deploy, manage, and protect Apple devices at work. Over 45,000 organizations trust Mosyle to make millions of Apple devices work ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple.
Apple recently confirmed it has capped the number of open vulnerability reports that researchers can submit through its portal, with a 30-day cool-down period once you hit that cap. The reason is that a surge in AI-generated bug reports is flooding the review pipeline. I understand the instinct, but I think it’s the wrong response at exactly the wrong moment.
About Apple @ Work: Bradley Chambers has been an Apple IT admin since 2009. Through his experience deploying and managing firewalls, switches, a mobile device management system, enterprise grade WiFi, 1000s of Macs, and 1000s of iPads, Bradley will highlight ways in which Apple IT managers deploy Apple devices, build networks to support them, train users, share stories from the trenches of IT management, and ways Apple could improve its products for IT departments.
What is the cap?
Apple confirmed it introduced a cap and a 30-day cooldown period on submissions through its internal security portal back in June, requiring security researchers to request an increased quota if they hit the cap. Apple says this is an industry-wide problem, and they are not wrong. LLMs are now fast (and good) at discovering vulnerabilities in ways humans could never do, and review teams everywhere are struggling to keep pace with the volume.
However, a Financial Times report also tells the story of Bynario, a seven-person startup that had its submissions blocked after reporting five bugs to Apple this year and eight in 2025, one of which was patched in November. Apple is now reviewing Bynario’s findings, including a privilege-escalation exploit chain that could give an attacker full control of a Mac, but this is why Apple shouldn’t cap it. There has to be another way.
The Coldcard hack
If you want a real-world example of why the timing of this cap worries me, look at the Coldcard hack. Starting in late July, attackers drained more than $116 million in Bitcoin from thousands of hardware wallet addresses. The root cause was a firmware bug introduced back in March 2021, five years earlier, that silently caused the device to skip its true hardware random number generator and fall back to a much weaker software substitute when creating its private keys. That bug sat there undiscovered and unexploited for years.
I believe AI tools were likely a factor in how this flaw was finally found and exploited at scale. Whether that’s the full story or not, the broader point stands. AI tools can now surface years-old logic flaws in code that human researchers might never stumble upon through manual review. That’s the entire argument for why AI-assisted bug hunting matters right now, and it’s happening whether or not Apple’s portal has room for the reports.
Why a cap is the wrong path
... continue reading