Apple bug bounty program straining under flood of AI generated vulnerability reports

[NicholasCleverley]

Apple has cranked its top bug bounty payout up to 2 million dollars for sophisticated zero click exploit chains, with bonuses potentially pushing individual payouts past 5 million, but the interesting part of this story is what is actually straining the program right now

According to reporting picked up from the Financial Times, the real crisis isnt a shortage of researchers or a lack of money, its the sheer volume of AI generated vulnerability reports flooding in, since the same large language models that help skilled researchers automate the tedious parts of vulnerability analysis also let far less skilled people blast out hundreds of superficially plausible but ultimately useless submissions

Every single one of those reports still needs a human reviewer to figure out whether its a genuine zero day or just an AI hallucination dressed up convincingly in technical jargon, which means the triage burden has exploded even as the actual quality of incoming reports has gotten murkier on average

Apple has paid out more than 35 million total to over 800 researchers since the bounty program started, and its expanded categories plus rolled out a new systematic flagging mechanism specifically to speed up validation, which tells you how seriously theyre taking the backlog problem

This apparently isnt unique to Apple either, the FTs reporting suggests its an industry wide phenomenon hitting corporate bug bounty programs broadly, so basically every major tech company running one of these programs is dealing with the same AI assisted flood right now

Its a genuinely strange situation where the tools accelerating real vulnerability discovery are the same tools creating a haystack so much bigger that finding the actual needles is getting harder rather than easier

Apple struggles to keep pace with AI-powered bug hunters as vulnerability reports flood incryptobriefing.com

[BinaryMonk91]

This is such an ironic problem, the tools meant to help find real bugs faster are also the tools burying real bugs under a mountain of AI generated noise

[Dave_52]

Triage is genuinely the hard problem here, a human still has to look at every single submission and figure out if its real or just confident sounding nonsense, that doesnt scale no matter how much money you throw at it

[SGHolly]

I actually think this proves AI tools are working as intended for genuine researchers even if it creates noise, the accelerated discovery of complex vulnerabilities is a real and valuable outcome even with the tradeoff

[Analog Jay]

Curious what percentage of submissions are genuinely AI hallucinated junk versus just low effort human submissions that happen to use AI polish on the writing, those feel like different problems with different fixes

[AlphaGareth16]

This feels like a preview of what content moderation and customer support are already dealing with at scale, AI generated volume outpacing the human capacity to verify it

[Violet Tiger]

Every industry that relies on human review of large volumes of submissions is going to hit this same wall eventually, patent filings, academic papers, legal briefs, its the same triage nightmare everywhere

[Squid81]

The flagging mechanism Apple rolled out is probably going to end up being an AI system itself just to filter the AI generated submissions, which is a wild loop to be stuck in

[EmbeddingSpace]

35 million paid to 800 researchers over the life of the program is actually a pretty modest average payout, most of that pool is probably going to a small number of top tier hunters anyway

[Hermit]

2 million dollar top payout still seems low honestly given how much a genuine zero click iOS exploit chain is worth on the grey market to state actors, wonder if that gap keeps pushing top researchers away from official channels