AI-Generated Bug Reports Got So Bad Apple Capped Submissions, and a Real Flaw Almost Got Buried

The Financial Times reported this week that Apple has capped how many open bug bounty reports a security researcher can have at once, adding a 30-day cooldown before more can be submitted, after a flood of AI-generated low-quality reports overwhelmed its review team. The report says a real security flaw worth an estimated $100,000 to $200,000 nearly went unreported because of it.

What FT reported

Per FT's reporting, relayed by The Decoder and Digital Trends, Apple's security bounty team was buried under AI-generated vulnerability reports that read plausibly but described flaws that did not actually exist. Apple responded with a cap on open reports per researcher plus a 30-day cooldown before submitting more. The exact size of the cap, and FT's reported June 2026 date for the change, come from FT alone. We could not independently verify them; FT's own article sits behind a paywall we could not get past.

The flaw that almost got stuck

Italian security startup Bynario says its AI-assisted scanning tool, which it calls Atlas, found more than 50 possible macOS flaws in three weeks, according to what Bynario told FT. One of them is now tracked as CVE-2026-43760: Apple's own advisory confirms the flaw is real, rated high severity and patched in macOS Sonoma 14.8.8 and macOS Tahoe 26.6. Bynario describes it as a Screen Sharing privilege escalation bug, a characterization that traces to Bynario's own account rather than Apple's advisory language; at least one independent researcher we found is skeptical of that specific description. Bynario's CEO, Alfredo Pesoli, told FT he estimated its black-market value at $100,000 to $200,000. Bynario says it initially could not submit the finding because Apple had already blocked further reports from its account.

Worth a caveat

Which AI model powered Atlas is unclear: Digital Trends names GPT-5.5, The Decoder just says ChatGPT, and Bynario's own site names neither. Apple's public advisory for the CVE appears to credit more than one independent discoverer, not Bynario alone, which FT's account does not mention. And Apple's headline $5 million-plus top bounty and its proof-of-impact target flags, sometimes described elsewhere as a response to this episode, actually date to an Apple announcement from October 2025, months before any of this happened.

Why a build studio cares

AI makes it cheap to generate a plausible-looking vulnerability report, and cheap to generate a hundred of them. Any bug bounty or code review process that assumes a report took real human effort to write needs a different filter now: proof of impact, not just a plausible writeup.

Next step: read The Decoder's coverage or Digital Trends' writeup. If your own security review process needs to filter for AI-generated noise, write to us at hello@gattyworks.com.