Apple caps bug bounty program due to deluge of AI submissions

Apple has altered its bug bounty program by introducing a hard limit on the number of reports a single party can file and by instituting a month-long pause after that limit is hit. The move was prompted by an overwhelming influx of findings produced with AI tools, which were crowding out submissions from human security researchers. By capping volume, Apple hopes to restore balance in its triage workflow and give more visibility to manually discovered vulnerabilities.

For engineers who maintain bug bounty platforms or integrate with Apple's portal, the new rules mean they must now track each participant's submission count and enforce the cool-off period automatically. Systems will need to generate alerts when a researcher approaches the cap and provide a mechanism for submitting the special request required to exceed it. This adds a layer of state management that was not previously necessary.

The immediate cost of adopting the new process is the development and maintenance of the counting and request-handling logic, as well as the potential for delayed processing of legitimate bugs if a researcher hits the cap. Teams will also need to allocate staff time to review and approve special-request submissions, which could divert resources from other security activities. While the cap reduces review overload, it may also slow down the intake of high-quality reports from prolific researchers.

The policy stops being effective once a researcher consistently reaches the cap and cannot obtain a special request quickly enough, potentially causing valuable findings to be postponed or missed. Additionally, the cap does not address the underlying quality of AI-generated reports; low-value submissions may still pass through the initial filter and consume reviewer time. Engineers must therefore consider complementary filtering or scoring mechanisms to further mitigate AI noise.

Apple's adjustment mirrors a broader trend, as evidenced by Google's recent overhaul that rewards harder-to-solve bugs over the easy, AI-found issues. This convergence suggests that other platforms may adopt similar caps or incentive structures, meaning engineers should anticipate comparable changes across the bug bounty ecosystem. Preparing for these shifts now can reduce disruption when similar policies are rolled out elsewhere.