Apple limits bug bounty reports as AI finds 50 macOS flaws in weeks

Apple announced it will cap the number of concurrent security reports researchers can keep open after an AI‑driven bug‑hunting effort uncovered more than 50 macOS vulnerabilities in just three weeks, straining its review process [1]. The move highlights a growing mismatch between the speed of AI‑generated flaw discovery and Apple’s ability to verify and patch them, prompting the company to deploy its own AI for triage and accelerate security updates.

AI‑generated flood of bugs

Bynario’s Atlas platform, running on GPT‑5.5, identified a chain of privilege‑escalation vulnerabilities that could give an attacker full control of a Mac, including a Screen Sharing flaw that allowed an authenticated VNC viewer to create root‑privileged files [1]. Apple assigned the issue CVE‑2026‑43760 and shipped a fix in macOS Tahoe 26.6, marking one of the first patches derived from an AI‑produced exploit rather than a vague code‑scan warning [1]. The sheer volume—over 50 possible macOS flaws in three weeks—exceeded Apple’s capacity to reproduce, confirm conditions, and prioritize fixes, leading the firm to limit how many open reports a researcher may maintain at once [1].

Apple’s response and market ripple

To cope with the backlog, Apple has begun using AI internally to triage incoming reports, separating “convincing‑looking nonsense” from genuine exploits [1]. The company also revamped its bug bounty program, raising the top payout to over $5 million and introducing “Target Flags” that require researchers to demonstrate that a flaw reaches protected system components, thereby improving signal quality [1]. Meanwhile, Apple accelerated its June 29 2026 security rollout—iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2—after noting that AI can shorten the window between a beta fix and potential exploitation [2]. This early release mirrors a broader industry shift where AI‑enabled tools pressure vendors to shrink patch timelines.

What to watch

• Next patch cadence: Whether Apple continues early releases for iOS 26.6 and macOS 27.0 as AI‑generated vulnerabilities become more common.
• Bug bounty policy evolution: Potential adjustments to the “open reports” cap or further incentive tweaks as AI tools proliferate.
• Competitor AI adoption: How other platform owners (e.g., Microsoft, Google) respond with their own AI‑assisted security triage or bounty reforms.

Apple’s tightening of bug‑bounty submissions underscores a pivotal tension: AI can surface flaws faster than human teams can validate them, forcing the tech giant to rethink both its vulnerability pipeline and the incentives it offers researchers. The outcome will shape how quickly future patches reach devices and whether AI becomes a net accelerator for security or a source of overwhelming noise.