Apple: Limit for bug reports per person

Apple is limiting how many vulnerability reports on Apple products a person can submit. Once this maximum number is reached, the person enters a 30-day “cooling-off period” during which they cannot submit any further reports. Apple is reacting to the flood of security notifications the company receives since AIs can automatically search for vulnerabilities.

The problem is currently widespread in the industry. Even Microsoft is reportedly no longer able to keep up with closing vulnerabilities found by AIs. This is because every quickly generated security report must subsequently be laboriously reviewed by humans. And not all of them are actually a problem – AIs also hallucinate about cyber issues.

Critical reports should still get through

With the new regulation, Apple wants to combat this AI Slop. To ensure that the most critical reports still reach the company, there is likely the possibility to request an increase in one's own limit. Those who are repeatedly flagged for AI Slop will first be temporarily banned for 180 days, and then permanently.

Apple fundamentally welcomes external vulnerability reports. As part of its Security Bounty Program, it paid up to two million US dollars for important tips, and with additional bonuses, one can even reach five million US dollars. Other companies like Node.js have since discontinued their bug bounty program; the team is discussing how to deal with the flood of LLM-generated security reports.

(rie)