Apple @ Work: Capping bug bounty submissions is the wrong response in the AI era of security threats

“Apple has imposed a cap on the number of vulnerability reports that security researchers can submit through its portal, citing a flood of AI‑generated bug reports that overwhelm its review pipeline. The move, announced in June, forces researchers to request higher quotas after hitting the limit and imposes a 30‑day cooldown. While Apple argues that large‑language models (LLMs) are uncovering flaws faster than human reviewers can process, the cap risks stalling the discovery of critical vulnerabilities, especially for high‑profile platforms like macOS and iOS that power a significant portion of U.S. enterprise and consumer devices. The Coldcard hack, which exploited a five‑year‑old firmware flaw, illustrates how AI tools can surface long‑hidden bugs that, if left unchecked, can lead to massive financial losses for U.S. businesses and consumers. Expert Analysis: This policy shift may temporarily reduce the velocity of vulnerability discovery, but it also signals a broader industry challenge: balancing the benefits of AI‑driven security research with the need for efficient, scalable review processes. If Apple and other vendors adopt more sophisticated triage systems instead of caps, U.S. enterprises could maintain robust security postures while still leveraging AI’s rapid detection capabilities.”