AI impact on cybersecurity vulnerability reporting

Apple struggles to keep pace with AI ‘bug’ hunters

No separate article for this desk or language yet.

Apple's security notes included WebKit vulnerabilities found using AI models.

In late July, Apple published security notes containing numerous WebKit vulnerabilities that were discovered with the assistance of OpenAI Codex Security and Anthropic's Claude model. These vulnerabilities involved issues that could potentially allow malicious web content to cause memory corruption or crash Safari.

According to reports, recent update packages contained approximately five times more security fixes than in previous periods.

Apple introduced restrictions on its vulnerability reporting system, including quotas and waiting periods.

In June 2026, Apple introduced restrictions to its vulnerability reporting system, including a quota on simultaneously open reports and a 30-day waiting period for new submissions. The company stated these changes were necessary to manage a wave of AI-generated security reports across the industry.

Apple described low-quality AI-generated reports as 'AI slop,' noting that such reports require review by security experts to verify correctness. While the system limits simultaneous reports, researchers can request a higher quota for critical findings. Additionally, Apple utilizes AI to classify and prioritize incoming vulnerability reports.

Bynario submitted eight vulnerabilities to Apple.

In 2025, the cybersecurity startup Bynario submitted eight vulnerabilities to Apple. During this process, the company reported that after making five new submissions, Apple's reporting system stopped accepting further applications due to new quota restrictions.

Bynario's findings included a privilege escalation chain that could allow an attacker to gain unlimited access and full control of a computer. One of the vulnerabilities submitted by the startup was addressed in a software update published in November.