Apple's security vulnerability reporting system is overwhelmed by AI-generated submissions, forcing the company to cap researcher submissions and inadvertently blocking legitimate critical bugs from review.
Apple's bug bounty program faces a growing problem: AI-generated spam is clogging the review pipeline so severely that the company has implemented submission caps per researcher.
The consequences became apparent when Italian startup Bynario discovered a serious macOS vulnerability worth up to $200,000 on the black market but couldn't initially report it through official channels due to submission limits triggered by the influx of fabricated reports.
The situation highlights a broader challenge facing technology companies: as AI tools become more accessible, malicious actors and low-effort participants flood bug bounty programs with worthless submissions. Rather than dedicating resources to filtering submissions, Apple has chosen to restrict legitimate researchers' ability to report issues.
Bynario eventually found a way to report the vulnerability, but the delay raises questions about how many other genuine security issues might slip through the cracks or remain unreported entirely. Security researchers depend on bug bounty programs as a legitimate way to disclose vulnerabilities responsibly, earning rewards while helping companies patch flaws before malicious actors exploit them.
The submission caps create a perverse incentive structure. Legitimate researchers face barriers to reporting, while the underlying AI spam problem remains unaddressed. This could push security researchers toward alternative disclosure channels or encourage them to sell vulnerabilities on the black market—the opposite of what responsible disclosure programs aim to achieve.
Apple's approach mirrors challenges other major tech companies face as they scale security operations. Google, Microsoft, and others have all experienced similar issues with low-quality submissions overwhelming their systems. However, simply capping submissions rather than improving filtering mechanisms may prove counterproductive in the long term.
The incident underscores the need for smarter intake systems that can distinguish between legitimate research and automated spam, rather than blanket restrictions that harm the security research community Apple ultimately depends on.
Cyberattacks against hedge funds and private equity firms have been attributed to UNC6671, an extortion group connected to the BlackFile threat actors. The campaign represents an escalating threat to the financial sector.
A Go-based malware distributed through ClickFix attacks is targeting macOS users to steal cryptocurrency, passwords, and Apple Keychain data. The infostealer campaign combines social engineering with credential harvesting.
A former NSA official has warned against connecting water infrastructure controllers to the internet following suspected Iranian cyberattacks on U.S. water systems.
Security researchers scanning Polish government websites discovered critical vulnerabilities that could expose courts, hospitals, and airports to cyberattacks. The vulnerabilities stem from common software used to manage and display web content.