A Milan-based cybersecurity startup says it discovered a critical macOS vulnerability capable of granting full control over a Mac, only to find itself unable to report the bug after Apple imposed a new cap on the number of submissions researchers can file.
A High-Value Bug Left in Limbo
The startup claims it uncovered a full-takeover flaw in Apple's desktop operating system, the kind of vulnerability that would typically command a hefty payout under Apple's security bounty program. According to the researchers, the flaw could have been eligible for a reward in the region of $200,000, reflecting the severity of a bug that allows complete system compromise.
The company says it leaned on ChatGPT during its research process, using the AI tool to help identify and validate the weakness. But when it tried to formally submit the finding to Apple, it ran into an obstacle: a newly introduced limit on how many reports a single researcher or team can file.
A quarter-million-dollar exploit sat unreported, blocked not by Apple's engineers but by its own paperwork.
The AI Slop Dilemma
Apple's decision to cap submissions appears to be a response to a broader industry headache: a surge of low-quality, AI-generated vulnerability reports flooding bug bounty programs. As large language models make it easier for anyone to churn out plausible-looking security claims, platforms have been inundated with what critics call "AI slop"—reports that look legitimate but often contain little of substance.
The irony, as the Milan firm's case illustrates, is that measures designed to filter out noise can also block genuine, high-impact findings. A researcher who used AI as a legitimate tool to uncover a real flaw found the door closed by rules meant to stop AI-driven spam.
The episode highlights the tension facing companies that run bounty programs at scale:
- AI tools are lowering the barrier to both real research and mass-produced junk reports.
- Submission caps and filters risk penalizing legitimate researchers alongside bad actors.
- Critical vulnerabilities can go unpatched when reporting channels become clogged or restricted.
Why It Matters
For Apple, which markets its platforms on the strength of their security, an unreported full-takeover exploit represents exactly the scenario its bounty program is meant to prevent. The company relies on outside researchers to surface serious flaws before malicious actors exploit them, and any friction in that pipeline can leave users exposed.
The case under