The Financial Times reported Sunday that Apple has put a ceiling on bug reporting. Researchers using Feedback Assistant now hit a cap on how many reports they can have open at one time, and running into it triggers a 30-day cool-off before they can file again. The portal was changed quietly, in June. Apple’s stated reason is the volume of AI-assisted submissions arriving faster than anyone can read them. Researchers who need more room can apply for a higher quota.
This is the part the security industry did not game out. Two years of argument about AI and vulnerability research assumed the fight would be over whether models could find real bugs. They can. The problem is that they also produce enormous quantities of confident, well-formatted reports describing flaws that do not exist — and a triage queue cannot tell the difference without a human reading each one. Apple is not drowning in attacks. It is drowning in paperwork that looks exactly like the real thing.
The cost showed up immediately. Bynario, an Italian security startup, filed more than 50 vulnerabilities to Apple in roughly three weeks using AI-assisted analysis. One of them was a privilege-escalation chain that its team says would hand an attacker full control of a Mac. Chief executive Alfredo Pesoli put the black-market value at $100,000 to $200,000. He could not report it: the account had already been throttled. Apple has since contacted the company directly.
Our take: A rate limit is a triage confession. It treats every report as identical because the reviewer cannot afford to look, which means the throttle lands on the researcher with the real exploit and the researcher with 40 hallucinated ones at exactly the same moment. The binding constraint was never submission volume — it is human verification capacity, and verification is the part of this job that scales the same way generation does. Apple met an automation problem with a manual-era lever. The vendor that fixes this ships an AI triage layer, not a quota.
Apple is late, not first
Open-source maintainers hit this wall a year ahead of the trillion-dollar company. The curl project and the Internet Bug Bounty both throttled submissions after AI-generated reports overwhelmed volunteer reviewers — the difference being that curl is run by a handful of people and Apple is not. What makes this week notable is scale: it is the first time a major commercial vendor has formally rate-limited AI-assisted disclosure rather than absorbing the cost.
Bug bounty programs have always run on an implicit trade. The vendor gets cheap security research; the researcher gets paid only for findings that hold up. That arithmetic worked because writing a plausible-looking vulnerability report was expensive. It is now nearly free, and the cost of separating signal from noise sits entirely on the vendor. Every incentive in the model just inverted.
What to watch
- Whether the quota system develops a reputation tier. Apple lets researchers request higher limits. The obvious next step is standing quota tied to historical accuracy — which turns bug bounty into a credit score and quietly locks out newcomers.
- Where the unread bugs go. Pesoli named a price because there is a market at that price. A throttled disclosure channel does not reduce the number of live flaws; it changes who finds out first.
- Which vendor copies it. Microsoft, Google and the major bounty platforms are all running the same inbox math. Apple moving first makes the second move much cheaper politically.
- Automated triage, not automated limits. The models generating this flood are the same ones that could reproduce a claimed exploit in a sandbox before a human ever sees it. Nobody has shipped that at scale yet.