Apple Is Now Rationing Bug Reports. Thank the AI Slop Flood.

TL;DR

Apple is now rationing vulnerability reports. According to the Financial Times, the company has introduced a cap on how many bug reports a researcher can submit, plus a 30-day cool-off period once you hit it, citing a deluge of AI-assisted submissions (researchers with a track record can request higher quotas). That makes Apple the biggest vendor yet to formally throttle the intake side of security research, and it caps a six-month industry retreat: curl killed its bounty in January, Bugcrowd watched submissions quadruple in three weeks in March, HackerOne and Nextcloud paused programs in the spring, and GitHub slashed public payouts by up to two-thirds last week. The twist: six days before the cap surfaced, Apple's own security notes credited Claude and OpenAI's Codex Security with finding real CVEs. AI is simultaneously the best bug hunter in the pipeline and the reason the pipeline is clogged.

What Apple actually changed

The FT reports Apple is struggling to keep pace with a surge of AI-generated vulnerability reports, and its answer is a quota: a hard cap on submissions, a 30-day cool-off for going over, and an exception process for researchers who ask for more headroom. The reporting indicates the limits land on Apple's bug intake through Feedback Assistant, the channel every registered developer already uses.

This sits on top of penalties Apple had already written into its Apple Security Bounty guidelines: repeatedly submitting ineligible reports, explicitly including issues "discovered by AI without proper validation," gets your reports paused for 180 days, and more than two pauses gets you permanently removed from the program. While paused, you are ineligible for rewards and advisory credit.

Note the escalation. The old rules punished bad reports after triage. The new cap rations reports before anyone reads them. Apple will still pay up to $2 million for a zero-click exploit chain; it would just rather you didn't CC it on your model's every hallucination.

Six months of bounty retreat

Apple is not the first to blink, just the largest. The timeline reads like a slow-motion capitulation.

The canary was curl. Daniel Stenberg shut down the project's bug bounty on January 31 after nearly seven years, over $100,000 paid, and 87 confirmed vulnerabilities. His numbers explain why: for years, north of 15% of submissions turned out to be real vulnerabilities. In 2025 that rate collapsed below 5% as AI-generated reports flooded in, while peer projects without curl's profile saw flat volume. Reports now go through GitHub, unpaid, with a standing warning that garbage earns a ban.

Then it spread to the platforms. Decrypt reported that submissions on Bugcrowd more than quadrupled during three weeks in March, and the company said most of them were fake. HackerOne paused its Internet Bug Bounty program in the spring. Nextcloud suspended payouts entirely, saying it had been "unable to find ways to responsibly handle the massive increase of low quality reports."

GitHub's move on July 27 was the most surgical. The Register reported it split the program in two: the public tier had its payouts gutted, while a new invite-only VIP tier keeps the old money for researchers with a proven record (at least one accepted critical, or seven accepted findings). New researchers get four report slots until they prove they are not a script.

The asymmetry that breaks the model

Bug bounties were built on an assumption that writing a plausible vulnerability report costs effort. That assumption is dead. An LLM can generate a report that cites real functions, plausible memory corruption, and a confident severity rating in seconds, and it costs the sender nothing. Verifying that report still costs a senior security engineer real hours, because a fake that is 95% plausible takes longer to disprove than an obvious one.

It is the robocall problem wearing a security badge: when dialing became free, the cost of the call moved entirely to the person answering, and eventually nobody picked up unknown numbers. Caps, cool-offs, and invite-only tiers are the security world's version of caller ID, a way to make senders spend reputation before receivers spend attention.

The uncomfortable twist: AI also finds the real ones

Here is what makes this genuinely hard, and why Apple's move is a rationing scheme rather than an AI ban. On July 27, six days before the cap made headlines, Apple shipped security updates for iOS 26.6 and its siblings fixing 30 distinct CVEs, and 9to5Mac noticed the credits read like a model leaderboard: Anthropic's Claude and a Claude Mythos preview, OpenAI's Codex Security, Z.AI's GLM, and NVIDIA's AI Red Team all got named for real, fixed vulnerabilities. One research team, Calif.io, had previously used Mythos to build a working macOS exploit in five days.

So the same week, AI-assisted research earned advisory credits from Apple and AI-generated noise earned a quota from Apple. Both things are true, and the difference is exactly one word in Apple's own guidelines: validation. A model that finds a bug and a human who confirms it with a working proof of concept is a researcher. A model that finds "a bug" and a human who hits submit is a spam cannon.

What this means for you

If you do vulnerability research with AI in the loop, the era of speculative volume is over. Reputation is becoming the scarce currency: GitHub's VIP tier, Apple's quota exceptions, and Stenberg's ban policy all price future access on past accuracy. Validate everything, attach a proof of concept, and treat every submission like it draws down a limited account, because now it literally does.

If you maintain an open-source project with any security surface, curl is your preview. Decide now what your intake policy is for unvalidated AI reports, before the flood decides for you. And if you are building the tools, the market signal is loud: the value is not in models that can generate findings, it is in systems that can cheaply verify them. The vendor who solves triage at slop scale gets to turn this whole mess back into a pipeline.

Key Takeaways

• Apple has capped bug report submissions and added a 30-day cool-off for researchers who exceed it, citing a surge of AI-assisted reports; higher quotas are available on request, per the Financial Times.
• Apple's bounty guidelines already punish unvalidated AI-discovered reports with 180-day processing pauses and permanent removal after more than two pauses.
• It is the biggest name in a six-month retreat: curl ended its bounty in January after its valid-report rate fell from over 15% to under 5%, Bugcrowd submissions quadrupled in three weeks in March, HackerOne and Nextcloud paused programs, and GitHub cut public payouts from $30k to $10k for criticals on July 27.
• The economics are the problem: generating a plausible fake report is free, disproving it costs expert hours, so programs are making senders spend reputation first.
• AI-assisted research still works when validated: Apple's July 27 updates credited Claude, Codex Security, GLM, and NVIDIA's AI Red Team across 30 fixed CVEs.
• Expect reputation-gated disclosure everywhere: proven researchers keep access and payouts, anonymous volume gets rate-limited at the door.

Sources: Financial Times, Techmeme, Apple Security Bounty guidelines, Apple Security Research blog, Daniel Stenberg, The Register, Decrypt, 9to5Mac