Apple has quietly capped the number of bug reports security researchers can submit, a direct response to a flood of low-quality, AI-generated submissions that are clogging its review pipeline. The move, reported by the Financial Times and covered by The Decoder on Aug 2, 2026, has created a dangerous side effect: at least one legitimate, serious vulnerability is now sitting unreported.
The Italian startup Bynario used ChatGPT to discover a macOS flaw that could give attackers full control over a machine. But when the team tried to submit it to Apple, the company had already blocked further submissions. Bynario CEO Alfredo Pesoli estimates the flaw's black-market value at $100,000 to $200,000. That is a significant prize for any criminal group.
Apple has since reached out to Bynario, according to Pesoli, but the episode highlights a growing tension in how the industry handles vulnerability discovery. The company is itself using AI from Anthropic and OpenAI to hunt for bugs, while simultaneously struggling with the fallout of AI-generated reports that contain hallucinated vulnerabilities.
The AI Report Flood
The cap is not about limiting legitimate research. It is about survival. Security teams are drowning in submissions that look plausible but describe vulnerabilities that do not exist. These hallucinated reports waste reviewer time and push real findings to the back of the queue.
Apple's latest updates included five times as many fixes as usual, a sign that its internal AI-assisted hunting is working. But the external pipeline is another story. The company now appears to be prioritizing quality control over volume, even if that means missing some genuine discoveries.
Bynario's experience shows the cost of that trade-off. The startup found a real, critical flaw, but could not get it into Apple's system. The window between discovery and disclosure is exactly when attackers are most likely to exploit a vulnerability.
Bug Bounty Programs Under Strain
Rafe Pilling, a security expert at Sophos, told the FT that bug bounty programs have shifted from finding vulnerabilities to validating them "at machine speed." That is a fundamental change in how these programs operate.
Traditionally, bug bounties rewarded researchers for discovering new flaws. Now, the bottleneck is not discovery but verification. With AI generating thousands of reports, human reviewers cannot keep up. The result is a system that is increasingly selective, and sometimes arbitrary, about what it accepts.
Stay ahead of the AI curve
The most important updates, news, and content — delivered weekly.
No spam. Unsubscribe anytime.
The question is whether bug bounty programs can survive long-term. If companies cannot trust the submissions they receive, they may stop relying on outside researchers altogether.
A Shift Toward In-House Discovery
Big tech companies might handle vulnerability discovery on their own. Apple's use of AI from Anthropic and OpenAI suggests that direction. If internal tools can find and fix flaws faster than external researchers can report them, the need for public bounties diminishes.
That would be a major change. Bug bounty programs have long been a cornerstone of cybersecurity, offering rewards for valid vulnerabilities and creating a global network of independent researchers. But the economics are shifting.
AI is a cybersecurity risk, but not the way you'd think. The danger is not just smarter attacks. It is the sheer volume of noise that AI can generate, noise that buries real signals and creates gaps in coverage.
A Real Vulnerability, Unreported
The Bynario case is a concrete example of that gap. A serious macOS vulnerability, worth up to $200,000 on the black market, went unreported because of a submission cap. Apple's later outreach suggests the company is aware of the problem, but the damage may already be done.
Pesoli's estimate of $100,000 to $200,000 is based on what similar flaws have fetched in underground markets. That is not a trivial sum. It is enough to fund a targeted attack campaign or a sophisticated exploit chain.
For now, the vulnerability remains in limbo. Apple has reached out, but it is unclear whether Bynario will be able to submit its findings or receive a bounty. The episode underscores a broader issue: as AI reshapes cybersecurity, the rules of engagement are being rewritten, sometimes with real-world consequences.