Apple Caps AI Bug Reports After Submission Flood

Apple has put a cap on how many security reports researchers can file through Feedback Assistant, adding a 30-day cool-off period after the queue buckled under AI-generated submissions. The change, first reported by the Financial Times on August 2, 2026, makes Apple the largest consumer tech vendor to formally rate-limit AI-assisted bug disclosure, a move that already cost one Italian security firm its window to report a real, root-level macOS flaw.

What Apple Actually Changed

Feedback Assistant, Apple’s channel for security researchers to submit vulnerability reports, now enforces a submission cap paired with a 30-day cool-off period once a researcher hits it. Apple confirmed the move after the Financial Times broke the story, and it was corroborated the same day by Digital Trends, Seeking Alpha, and the-decoder.com. Researchers who need more room can request a higher quota, so this isn’t a hard shutdown. It’s a throttle.

The trigger is volume, not malice. Apple’s own Bounty Guidelines already ask researchers to skip lengthy AI-generated writeups and submit working proof-of-concept exploits instead. That guidance clearly wasn’t enough. As AI tools got better at scanning codebases for plausible-looking flaws, Apple’s review team started drowning in reports that read like real vulnerabilities but weren’t.

Apple paired the cap with two things that soften the blow for serious researchers: a bug bounty ceiling that now tops $5 million for the most severe exploit chains (with a $2 million base payout for zero-click exploits as of November 2025), and a new “Target Flags” requirement forcing researchers to prove a reported flaw actually reaches a protected part of the system, rather than just theorizing about it. Since the bounty program started, Apple has paid out more than $35 million to over 800 researchers.

The Bynario Case: A Real Bug Blocked by the Cap

This is where the policy gets uncomfortable. Italian cybersecurity firm Bynario built a research platform called Atlas on top of GPT-5.5. In three weeks, Atlas surfaced more than 50 possible macOS vulnerabilities, an output volume that would have taken a human team months.

Most of those findings needed human triage to separate signal from noise, which is exactly the workload Apple’s cap is designed to control. But Bynario also found something that wasn’t noise: a privilege-escalation chain the company says could hand an attacker full control of a Mac. According to the-decoder.com’s account of the FT reporting, Bynario could not immediately submit that finding, because its Feedback Assistant quota had already been used up by earlier, less critical reports.

Bynario CEO Alfredo Pesoli estimated the unreported flaw’s black-market value at $100,000 to $200,000, arguing that rate-limiting itself creates a security gap by delaying disclosure of genuine, serious bugs. Reported via the-decoder.com’s coverage of the Financial Times, Aug 2, 2026

Apple has since reached out to Bynario directly. But the sequence of events, real vulnerability found, real vulnerability blocked by a volume cap, is the strongest evidence critics have that a blanket throttle punishes prolific good researchers right alongside the spam generators.

CVE-2026-43760: The Flaw That Made It Through

One of Bynario’s Atlas-sourced findings is now tracked as CVE-2026-43760, a macOS Screen Sharing vulnerability. It lets an authenticated VNC viewer read protected data and write files with root privileges, provided Screen Sharing or Remote Management is enabled with legacy VNC password access. Apple patched it in macOS Tahoe 26.6.

It’s a useful reminder that “AI-generated report” and “fake vulnerability” aren’t synonyms. Apple’s own security advisories have separately credited AI-assisted researchers using Claude for a kernel vulnerability finding and OpenAI’s Codex Security for several WebKit fixes, per Digital Trends’ review of recent advisories. Apple is benefiting from the same class of tooling that’s currently straining its review queue. That’s the whole dilemma in one sentence.

curl Already Ran This Experiment

Apple isn’t the first to hit this wall, it’s just the biggest name to hit it. The open-source curl project started complaining about “AI slop” reports as early as January 2024. By 2025, founder Daniel Stenberg was describing curl’s HackerOne queue as effectively DDoSed by AI-generated submissions.

The confirmed-vulnerability rate on curl’s reports fell from north of 15% before 2025 to below 5% during 2025, according to Stenberg’s own blog post announcing the end of curl’s bug bounty program on January 31, 2026. Curl went further in mid-2026, running a full submission blackout from July 1 to August 3, the project’s self-described “summer of bliss.”

Not even one in twenty was real. Daniel Stenberg, founder and lead developer, curl project, on 2025 submission quality (daniel.haxx.se, Jan 26, 2026)

There’s a twist worth flagging before anyone treats this as a settled crisis narrative. Reporting from byteiota.com notes that by the time curl returned to HackerOne in March 2026, the worst of the AI slop had cleared out, with confirmed rates recovering to 15 to 16%. If that pattern holds, model quality may be improving faster than the doom framing suggests, which would make Apple’s cap a temporary bridge rather than a permanent fix. Worth watching, not yet proven.

The Numbers Behind the Flood

Apple’s move sits inside a documented, industry-wide trend, not an isolated overreaction. HackerOne’s own platform research, “Finding Fast, Fixing Slow”, lays out the shape of the problem clearly.

The most important number in that table isn’t the 76% surge, it’s the fact that the confirmed-exploitable rate held roughly steady around 25% even as volume climbed. That undercuts the simplest version of the “it’s all AI slop” narrative. The real bottleneck, per HackerOne’s own analysis, is organizational triage and remediation capacity, not detection speed. Mean time-to-remediate actually improved by roughly 80% over the same period, and the backlog still grew 21x. Vendors are getting faster per item and still losing ground.

Jamf senior security strategy manager Adam Boynton frames the deeper shift plainly:

An arms race between defenders and attackers who are both, increasingly, running the same kind of tools. Adam Boynton, Jamf, Computerworld, late July 2026

What This Means If You Hunt Bugs for a Living

If you report vulnerabilities for a living, or you run a program that receives them, the Bynario episode is the practical lesson, not the HackerOne dataset.

For independent researchers

• Speed and quality now matter more than raw volume. A single well-documented, reproducible proof-of-concept with clear evidence the flaw reaches a protected part of the system will clear review faster than five AI-drafted maybes.
• Treat one strong report as more valuable than a batch of theoretical ones, especially somewhere with a hard cap like Feedback Assistant now has.
• If you’re running high submission volume through automated tooling, prioritize your most serious finding first. Bynario’s case shows exactly what happens if you don’t.

For security engineering leaders

• Apple’s cap plus higher top-end bounty plus proof-of-reach requirement is a repeatable playbook worth benchmarking against your own triage-to-submission ratio.
• Assume any public-facing service is now being probed by AI-assisted researchers, and attackers, at a materially higher rate than 18 months ago. Plan patch-response SLAs around that, not around 2023-era volume.

The Case Against Rate-Limiting

A cap is a blunt instrument. It can’t tell the difference between a spam generator and a small firm that happens to be genuinely fast because its tooling is good. Bynario is the clearest proof of that: real research, real finding, blocked by a threshold that had already been used up on lower-value reports.

There’s also a framing issue worth being precise about. Several outlets describe Apple as the first major vendor to formally rate-limit AI-assisted disclosure. That’s only true if you don’t count curl’s earlier bounty shutdown and blackout as a “formal vendor policy,” since curl is open source infrastructure rather than a commercial vendor. Worth noting rather than glossing over, especially for anyone citing this as a genuine first.

FAQ

Apple added a submission cap and a 30-day cool-off period to Feedback Assistant after AI-generated reports overwhelmed its security review team. Researchers can request higher quotas if they need more room (Financial Times, Aug 2, 2026).

A macOS Screen Sharing vulnerability letting an authenticated VNC viewer access protected data and create root-privileged files. It was found by Bynario’s GPT-5.5-based Atlas tool and patched in macOS Tahoe 26.6.

Apple’s top bug bounty payout now exceeds $5 million for the most severe exploit chains, with a $2 million base for zero-click exploits as of November 2025. The program has paid over $35 million to 800-plus researchers total.

Curl’s confirmed-vulnerability rate collapsed from over 15% to under 5% by 2025 as AI-generated reports flooded its HackerOne queue. Founder Daniel Stenberg ended the bounty program in January 2026 and paused all submissions from July 1 to August 3, 2026.

Yes. HackerOne reports 210% year-over-year growth in valid AI-assisted vulnerability findings, and Apple’s own advisories credit Claude- and Codex-assisted research for real kernel and WebKit fixes, even as low-quality automated submissions also surged.

Where This Goes Next

Apple’s cap isn’t really about AI slop, that’s the surface story. The real story is that vendors have run out of triage capacity faster than they’ve run out of ways to generate reports, and nobody has a clean fix yet. Apple’s answer, throttle plus bigger reward plus proof-of-reach, is one bet. Curl’s blackout was another. Neither is guaranteed to hold if AI-generated report quality keeps improving on the roughly 12-month cycle curl’s own recovery suggests.

Three things worth watching over the next six to eighteen months:

1. Whether Apple’s quota-request process becomes a bottleneck of its own for legitimate high-volume researchers.
2. Whether other major vendors follow with their own formal caps, or whether Target-Flag-style proof-of-reach requirements spread faster than caps do.
3. Whether curl’s post-blackout confirmed-rate recovery (15 to 16%) repeats industry-wide, which would suggest this is a temporary adjustment period rather than a permanent structural shift.

Want the next update on this story, and the rest of what’s actually changing in AI and security, delivered before it hits your feed? Subscribe to The Neural Loop at neuralwired.com/newsletter.