Apple yakaita shanduko huru kune yayo bug bounty chirongwa, introducing submission caps and a 30-day cooldown period in response to a surge of low-quality vulnerability reports generated by artificial intelligence tools .
The adjustments, confirmed by the Financial Times, reflect a growing challenge facing the tech industry: AI systems are now widely used to scan code for potential security issues, but the reports they produce often contain unverified claims or outright “hallucinations” . Apple’s security review team has been overwhelmed by the volume of these submissions, which consume substantial resources and risk obscuring critical vulnerabilities discovered by human researchers.
Security professionals have reported that AI-powered scanning tools can flag thousands of potential issues in a single codebase, many of which turn out to be false positives or misinterpretations of security boundaries. The sheer volume makes it difficult for Apple’s security team to prioritize genuine threats. By capping submissions and requiring researchers to apply for exceptions, Apple aims to restore focus to high-quality, manually validated security research .
Not an Isolated Move
Apple is not alone in responding to this new reality. Google made similar adjustments to its own bug bounty program earlier this year, shifting rewards toward solutions for complex security challenges rather than simple vulnerabilities that AI can easily identify . The move reflects a broader industry recalibration as AI becomes a double-edged sword in cybersecurity—a powerful tool for defenders but also a source of noise that can overwhelm security operations.
ZveApple, the timing is notable. The company is in the midst of a major AI push with the launch of Siri AI and Apple Intelligence across its platforms, making the security of its own AI systems an increasingly critical concern . The bug bounty program changes suggest Apple is taking steps to ensure that its security review process remains effective even as the volume of AI-aided research grows.
The new rules apply to submissions made through Apple’s internal security portal, which researchers can access by applying to participate in the bug bounty program. Those who need to submit more than the capped number of reports must now make a formal request to Apple’s security team. The 30-day cooldown period gives researchers time to thoroughly verify their findings before submission, theoretically reducing the number of duplicate or invalid reports.
A Sign of Things to Come
As AI tools for code analysis become more sophisticated and accessible, other tech companies are likely to follow Apple and Google’s lead in adjusting their vulnerability disclosure programs. The challenge lies in balancing the benefits of AI-assisted security research—which can identify patterns and edge cases that humans might miss—against the operational burden of processing machine-generated reports.
Apple’s move also highlights a subtle but important dynamic: while AI is making security research more accessible, it is also creating a quality control problem that the industry must address. The 30-day cooldown and submission caps are essentially friction mechanisms designed to encourage researchers to apply human judgment before submitting reports.
For now, Apple’s bug bounty program remains open to security researchers who find genuine vulnerabilities in Apple software and services. But the new rules make it clear: quality matters more than quantity, and AI-generated noise will not be tolerated.
