Apple bug bounty program straining under flood of AI generated vulnerability reports

[NicholasCleverley]

Apple has cranked its top bug bounty payout up to 2 million dollars for sophisticated zero click exploit chains, with bonuses potentially pushing individual payouts past 5 million, but the interesting part of this story is what is actually straining the program right now

According to reporting picked up from the Financial Times, the real crisis isnt a shortage of researchers or a lack of money, its the sheer volume of AI generated vulnerability reports flooding in, since the same large language models that help skilled researchers automate the tedious parts of vulnerability analysis also let far less skilled people blast out hundreds of superficially plausible but ultimately useless submissions

Every single one of those reports still needs a human reviewer to figure out whether its a genuine zero day or just an AI hallucination dressed up convincingly in technical jargon, which means the triage burden has exploded even as the actual quality of incoming reports has gotten murkier on average

Apple has paid out more than 35 million total to over 800 researchers since the bounty program started, and its expanded categories plus rolled out a new systematic flagging mechanism specifically to speed up validation, which tells you how seriously theyre taking the backlog problem

This apparently isnt unique to Apple either, the FTs reporting suggests its an industry wide phenomenon hitting corporate bug bounty programs broadly, so basically every major tech company running one of these programs is dealing with the same AI assisted flood right now

Its a genuinely strange situation where the tools accelerating real vulnerability discovery are the same tools creating a haystack so much bigger that finding the actual needles is getting harder rather than easier

Apple struggles to keep pace with AI-powered bug hunters as vulnerability reports flood incryptobriefing.com