Apple Limits Bug Bounty Submissions
Apple caps bug bounty submissions due to AI-generated reports overwhelming review teams, with a 30-day cool-off period and submission limits.
Key points
- Apple has introduced a cap and 30-day cool-off period on bug bounty submissions through its internal security portal.
- The change is in response to a high volume of poor-quality submissions from amateur bug hunters using AI to locate vulnerabilities.
- Cybersecurity startup Bynario used ChatGPT to locate over 50 macOS bugs in three weeks, but was restricted from submitting more reports.
- Apple's security team relies primarily on human review, but the company is also using AI to parse submissions.
- Google has also overhauled its bug bounty program in response to the proliferation of AI tools, emphasizing higher payouts for difficult-to-solve problems.
- The limit may affect the discovery of critical vulnerabilities, but researchers can request an increase in submission limits.
Apple has introduced limits on its bug bounty program due to an overwhelming number of submissions generated by AI tools. The company has implemented a cap on the number of submissions a researcher can make, as well as a 30-day cool-off period. This change is intended to reduce the number of poor-quality submissions and prevent real vulnerabilities from being lost in the deluge. The issue arose after cybersecurity startup Bynario used ChatGPT to locate over 50 macOS bugs in just three weeks. However, the company was restricted from submitting more reports due to the new limits. Apple's security team relies primarily on human review, but the company is also using AI to parse submissions. This approach has been overwhelmed by the sheer volume of AI-generated reports. The limit may affect the discovery of critical vulnerabilities, but researchers can request an increase in submission limits to ensure that important issues are not missed.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.