Apple AI Bug Flood Clogs Security Reports

Apple has implemented new limits on the number of software bug reports researchers can submit, a move prompted by an overwhelming influx of submissions largely generated by artificial intelligence tools. This policy adjustment, enacted in June, aims to manage the deluge of reports, which Apple describes as "AI slop" that often hallucinates security risks.

The tech giant is experiencing an industry-wide challenge where generative AI is transforming cybersecurity. While these tools increase the detection of real security flaws, they also generate a wave of low-quality submissions from amateur bug hunters. This situation has put significant pressure on internal security review systems.

Italian cybersecurity startup Bynario reported identifying over 50 bugs in MacBook operating systems within three weeks using ChatGPT. One critical vulnerability, a privilege escalation exploit chain, could grant an attacker full control of an Apple computer. However, Bynario was unable to submit this finding due to Apple's new submission caps.

Apple has since stated it is in contact with Bynario and reviewing its submissions. The company has introduced a cap and a 30-day cool-off period on its internal security portal, with a process for requesting increased quotas. Human review is required for each alleged breach, though Apple is also using AI internally for triage.

Researchers can request an increase to their submission limits at any time to ensure critical reports reach Apple's security teams. This adjustment reflects the dual impact of AI in cybersecurity—making it easier for both amateurs to submit speculative reports and skilled researchers to find dangerous exploits, shifting the focus to validating and prioritizing these findings at machine speed.