Apple's bug report caps clash with AI-assisted security research surge

Apple recently imposed limits on the number of security reports some researchers can have open simultaneously, forcing those who hit the cap to wait 30 days before submitting additional potential vulnerabilities through the company's security submission portal.

AI-generated noise swamps the system#

The restrictions arrived in June as Apple faced a deluge of AI-assisted reports—many turning out to be false positives or what researchers call "AI slop." While AI tools excel at spotting possible flaws and drafting detailed submissions, each one still requires human review and verification.

Cybersecurity firm Bynario highlighted the issue after hitting Apple's cap. Using GPT-5.5 via its Atlas platform, the Italian company discovered over 50 potential bugs in the latest macOS within three weeks. One discovery was genuine: a flaw in macOS Screen Sharing that could let authenticated users gain root-level access and read protected files. Apple assigned this issue CVE-2026-43760 and patched it in macOS Tahoe 26.6.

Bynario couldn't initially report the flaw because it had already reached Apple's limit for active submissions. Though Apple subsequently opened talks with the company to assess its findings, the incident illustrates how rapidly AI can overwhelm a review process built for human-speed research.

Triage becomes the bottleneck#

The problem extends industry-wide. Bug bounty platform HackerOne already uses AI for initial triage through Hai Triage, which evaluates incoming reports in minutes—faster than human teams can verify them. HackerOne's system classifies vulnerabilities, rates severity, and flags which ones warrant human analysis, though all final decisions rest with human reviewers.

As the cost of running AI-driven workflows drops, volume increasingly becomes the default. AI sorting can help clear backlogs, but it also risks misclassifying legitimate bugs as "AI slop," effectively delaying real research while doing little to stop plausible-sounding false positives.

A smarter approach might differentiate between researchers with proven track records—who could submit more—and those relying on AI without proper validation. Apple already requires affected versions, reproduction steps, and proof-of-concept code. A cap that penalizes high-volume but unproven submissions while protecting quality reporters could better balance thoroughness and speed.