AI Bug Report Slop Floods Apple And Hides A $200K MacOS Flaw
According to a recent Financial Times report, one of the companies dealing with these challenges is none other than Apple. In fact, Cupertino has had to limit the number of active bug reports individual researchers can keep open at one time, enforcing strict submission limits and temporary cooldown periods. The policy change comes after Apple's security engineers were inundated with waves of AI slop reports, i.e. low-quality, highly convincing reports containing entirely made-up flaws or purely theoretical risks.
While the new barriers are designed to protect engineers from burnout, they are already creating dangerous security blind spots. To wit, Italian cybersecurity startup Bynario revealed that it used OpenAI’s ChatGPT-5.5 via its Atlas platform to uncover more than 50 potential macOS vulnerabilities within three weeks, including a privilege-escalation exploit in macOS Screen Sharing (estimated to carry a black-market value of $100,000 to $200,000) that could allow an attacker to gain full control of a Mac. Yet, when Bynario attempted to submit the legitimate finding, Apple's new system blocked the report because the firm's submission inbox had hit its artificial ceiling. Apple has since reached out to Bynario to manually review the critical exploit, however.
The paradox for Big Tech is that AI is simultaneously proving to be an indispensable defensive asset. Apple itself relies heavily on frontier models from Anthropic and OpenAI to hunt for internal weaknesses, leading to recent software patches that contained five times as many security fixes as typical update cycles.
However, because AI can generate dozens of complex attack vectors in seconds, every incoming submission still requires manual triage to confirm if a bug can actually be reproduced in a real-world environment. With casual users and security enthusiasts dumping automated code scans into reporting portals in hopes of landing lucrative payouts, human reviewers are struggling to keep up.
To adapt to this machine-speed landscape, tech giants are forced to restructure how they reward researchers. Apple’s bug bounty program now tops out at over $5 million for the most severe exploit chains, but researchers must present concrete, verifiable proof, such as target flags, rather than automated speculation.
Main image credit: Apple
