Apple Limits Vulnerability Reports and Strengthens AI Verification

Apple has restricted the number of vulnerability reports that a single security researcher can submit simultaneously. This measure prioritizes reproducibility and verification quality over the quantity of reports, in response to the increasing detection of vulnerabilities through generative AI. Italian security startup Bynario claims to have fallen victim to Apple's vulnerability reporting restrictions, stating that it discovered over 50 vulnerabilities in the latest macOS using OpenAI's ChatGPT over three weeks. Bynario's CEO, Alfredo Pesole, explained that one of these vulnerabilities is an escalation of privilege chain that could grant attackers control over an entire Mac device, estimating the criminal market value of this vulnerability to be between $100,000 and $200,000. Apple has indicated that theoretical vulnerabilities discovered through AI tools are excluded from rewards and that it may suspend report processing for 180 days for repeated ineligible submissions. Apple does not rule out AI-based vulnerability detection and recently included OpenAI Codex Security in its list of discoverers in a security update. Bynario has reported that its AI system identified the CVE-2025-43377 vulnerability in macOS.