Apple announced it will limit the number of active security reports each researcher can maintain after an influx of AI‑produced submissions strained its review process. The change, revealed in early August, applies to all external security researchers worldwide and takes effect immediately. Apple’s move follows a surge of findings, some imagined, that overwhelmed its internal triage system.
The surge stems from the growing use of generative‑AI tools that can scan code, suggest exploit paths, and draft vulnerability reports at scale. While the technology enables rapid discovery of genuine flaws, it also produces many speculative or „hallucinated” claims that lack reproducible evidence. Apple’s security team reported difficulty separating actionable bugs from noise, leading to longer response times and delayed patches for critical issues. To manage the workload, the company now caps the number of open reports per researcher, forcing participants to prioritize the most credible findings.
Financial Times sources said the AI‑driven flood arrived after several independent researchers began leveraging large language models to automate parts of the bug‑hunting process. One researcher disclosed more than five dozen submissions in a single month, many of which described theoretical attack vectors that could not be reproduced. Apple’s internal security lead, who asked to remain anonymous, noted that the team spent weeks filtering out false positives, diverting resources from genuine threats. „We saw a dramatic rise in reports that sounded plausible but fell apart under basic testing,” the official said. The company’s new policy aims to reduce the backlog by limiting how many reports any one researcher can keep open, encouraging higher‑quality submissions.
Critics argue that capping open reports could discourage independent researchers from exploring novel attack surfaces, especially those that require iterative testing. However, Apple maintains the restriction is a temporary measure to restore balance between volume and veracity. „We value the contributions of the security community, but we must ensure our triage pipeline can handle the influx without compromising on thoroughness,” a company spokesperson explained. Industry observers note that other tech firms have adopted similar caps when faced with AI‑generated noise, suggesting a broader shift toward more disciplined vulnerability disclosure practices. The policy may push researchers to refine their use of AI, focusing on reproducible exploits rather than speculative ideas.
The new limits could reshape how security researchers interact with Apple’s bug bounty program. By forcing a tighter focus on high‑impact findings, the company hopes to accelerate patch deployment and protect users from real threats. In the longer term, the move may spur the development of AI tools that better distinguish between feasible vulnerabilities and imaginative scenarios, improving the overall efficiency of bug hunting across the tech sector.
What prompted Apple to cap open security reports? A sudden rise in AI‑generated submissions, many of which were speculative, overwhelmed Apple’s review team, leading to slower response times and delayed patches.
Will the cap affect the number of vulnerabilities discovered? The limit may reduce the total volume of reports, but it encourages researchers to submit only well‑validated findings, potentially increasing the quality and impact of discovered bugs.
How can researchers adapt to the new policy? Researchers are likely to prioritize reproducible exploits, use AI to assist rather than fully generate reports, and coordinate closely with Apple to ensure each submission meets higher evidentiary standards.