Apple recently announced that it has limited the number of open vulnerability reports researchers can submit via its portal, imposing a 30‑day cooldown once the limit is reached. The company says the increase in AI‑generated bug reports is overwhelming its review process. I see the rationale, but I believe this is the wrong move at precisely the wrong time.
About Apple @ Work: Bradley Chambers has served as an Apple IT administrator since 2009. Having deployed and managed firewalls, switches, MDM, enterprise Wi‑Fi, thousands of Macs and iPads, Bradley shares how Apple IT teams roll out devices, build supporting networks, train users, recount frontline IT stories, and suggest ways Apple could enhance its products for IT departments.
What is the cap?
Apple confirmed in June that it introduced a cap and a 30‑day cooldown on submissions through its internal security portal, requiring researchers to ask for a higher quota when they hit the limit. Apple calls this an industry‑wide issue, and it’s not mistaken. Large language models are now quick and effective at uncovering vulnerabilities that humans would likely miss, and security teams everywhere are struggling to keep up with the influx.
A Financial Times piece also highlights Bynario, a seven‑person startup that had its submissions blocked after reporting five bugs to Apple this year and eight in 2025, one of which was patched in November. Apple is now reviewing Bynario’s findings, including a privilege‑escalation chain that could grant an attacker full control of a Mac, which illustrates why imposing a cap is problematic. There must be a better approach.
To see why the timing of this cap concerns me, consider the Coldcard incident. Beginning in late July, attackers siphoned more than $116 million in Bitcoin from thousands of hardware‑wallet addresses. The underlying cause was a firmware bug introduced in March 2021 that silently bypassed the device’s true hardware random number generator, falling back to a weaker software substitute when generating private keys. That flaw lay dormant and unexploited for years.
I suspect AI tools played a role in discovering and exploiting this flaw at scale. Whether or not that is the complete story, the broader point remains: AI can surface long‑standing logical defects in code that human reviewers might never encounter through manual inspection. That is precisely why AI‑assisted bug hunting matters today, regardless of whether Apple’s portal has capacity for the reports.
Why a cap is the wrong path
Attackers face no submission limit, so neither should defenders. They do not need a 30‑day pause between exploit attempts, nor do they wait for a quota increase before continuing to probe a system for weaknesses. If defenders throttle the flow of AI‑assisted research reaching their security teams while attackers enjoy unrestricted AI‑powered attacks, a mismatch emerges.
AI‑generated low‑quality bug reports are a genuine operational challenge, but the remedy for a triage problem is improved triage, not a slowdown in submissions that ends up blocking legitimate reports.
For technology companies, triage must become more effective.