Apple Bug Bounty Limits AI Slop and Fake Reports

The report explains that mass-produced, low-quality AI-generated vulnerability submissions have overwhelmed Apple’s bug intake process, prompting the company to limit the number of open reports per researcher and impose a 30-day cooling-off period; this policy unintentionally blocked a legitimate, high-severity macOS privilege vulnerability reported by Bynario until media attention forced Apple to engage and remediate it. The story highlights consequences for triage efficiency, the risk of burying critical disclosures, and notes that other vendors (Google, GitHub) are also adjusting reward mechanisms while continuing to use AI to assist in security review.