Apple has placed a cap on the number of new security reports one researcher can keep open at once. Reports beyond that limit enter a 30-day cooling period unless the researcher requests more quota. The company introduced the restriction in June after AI-assisted submissions increased faster than its security team could review them.
The policy turns vulnerability disclosure into an admission-controlled queue. A researcher can use a model to inspect code, propose attack paths, draft reports, and generate test harnesses in parallel. Apple still has to reproduce each claim, determine reachability, separate duplicate symptoms from shared root causes, assign severity, coordinate engineering work, and ship patches across supported products. Cheap report production meets expensive validation at the portal.
the bottleneck moved to the receiving side
Apple’s public reporting guidance asks for affected versions, observed and expected behavior, reproduction steps, and a proof of concept or exploit. Its bounty guidelines call complete, actionable reports the priority and say most reports are resolved within 90 days. Those requirements describe work that survives contact with an engineer.
LLMs can now create a much larger class of submissions that resemble that work. Some contain real findings. Some describe theoretical conditions without a reachable path. Some repeat the same root cause through several crashes. Some hallucinate functions, versions, or security consequences. Every one arrives as a claim about a vendor’s code and consumes attention before anyone knows which class it belongs to.
Apple told the Financial Times, in a statement reproduced by 9to5Mac, that it adjusted the number of new reports a researcher may keep open because of the growing volume of AI-generated submissions. Researchers can request an increase to ensure critical findings reach the security team. The exception mechanism matters. A flat cap would punish a productive lab and a spray-and-pray bounty farmer equally. Quota review lets Apple inspect the researcher, the evidence, and the prior signal before widening the pipe.
The public guidelines add a harsher backstop. Repeated ineligible reports, including theoretical issues or AI-discovered claims submitted without human validation, can pause a researcher’s processing for 180 days. After more than two pauses, Apple may remove the researcher from the program. Reports carrying an applicable Target Flag or a packaged macOS or iOS virtualization can still demonstrate the issue strongly enough to route around a pause.
a real exploit can arrive inside the flood
Bynario, a seven-person security company, became the cleanest example of the admission problem. The firm told the Financial Times that its AI-assisted system found more than 50 possible macOS issues in three weeks. Its portal access reached Apple’s limit while the team still had findings it wanted reviewed. Apple later opened direct contact and began examining the submissions.
Bynario’s published work shows why volume cannot serve as a quality proxy. In July, the company disclosed CVE-2026-43760, a logic flaw in macOS Screen Sharing’s legacy VNC path. A viewer with the configured VNC password could make privileged file-copy helpers read protected files or create attacker-controlled files as root. Bynario used the write primitive to install a valid sudoers policy and demonstrated root command execution on Apple silicon with System Integrity Protection enabled.
The finding carried prerequisites: Screen Sharing or Remote Management had to be enabled, legacy VNC password control had to be configured, and the attacker needed that password. The research documented those conditions, compared native and legacy authentication paths, traced helper identities, tested negative controls, and showed the final security consequence. Apple fixed the issue in macOS Tahoe 26.6 and Sonoma 14.8.8.
That is the evidence burden an intake system should reward. A model may help find the credential mismatch. The report becomes useful through boundary analysis, controlled reproduction, exploit construction, version testing, and precise scoping. Apple cannot infer that custody from the number of tokens spent or the fluency of the submitted prose.
github built the same queue in public
Apple’s cap sits inside an industry response. On July 27, GitHub restructured its bug bounty program around a permanent invite-only VIP tier, lower public payouts, static rewards, and a HackerOne signal requirement. Researchers below the signal threshold receive up to four initial submissions while they establish a record. VIP researchers get faster responses, higher payouts, and a closer relationship with GitHub’s security engineers.
GitHub states the incentive directly: more submissions no longer produce more reward; better submissions do. The program now encodes researcher history as an operational primitive. A critical finding, two high-severity findings, four medium findings, or seven low findings can qualify someone for VIP review. The public program remains an entry path, with a smaller pipe and less money.
Apple and GitHub chose different controls, then converged on the same architecture. Open reporting survives. Unproven volume receives throttling. Validated researchers can earn more capacity. Proof has to become machine-routable through Target Flags, working exploits, complete reproduction packages, platform signal scores, or a trusted history.
the queue can be attacked from both directions
Loose intake lets low-cost submissions consume the review capacity needed for serious findings. Aggressive throttling can leave a real exploit waiting outside the portal. Both failures benefit attackers, who need neither a bounty account nor a coordinated disclosure timeline.
The useful design target is evidence-weighted flow control. Reports with a working exploit, Target Flag, reliable crash signature, tested version matrix, or clearly traced trust boundary should advance quickly. Duplicate and low-confidence claims can be grouped, deferred, or returned for validation. Researchers should see which evidence raises priority and how to request emergency review without needing press coverage to open a private channel.
Vendor-side automation can absorb some load. Models can cluster duplicates, compare reports with recent patches, execute harnesses in isolated environments, identify impossible version claims, and route components to owners. Final severity and remediation remain attached to human accountability because a convincing exploit can still omit deployment context, and a modest primitive can become severe when chained through another boundary.
The security industry’s old scarcity was finding enough bugs before adversaries did. AI has begun to manufacture a second scarcity: deciding which findings deserve belief, engineering time, and coordinated release authority. Apple put that scarcity into a rate limit. GitHub put it into a class system. The next disclosure infrastructure will be judged by how rarely either mechanism discards the one report that mattered.