Apple's bug bounty drowns in AI spam, delays real security reports

The real story isn't that Apple's bounty program exists or that AI spam exists, but that per-researcher submission caps are now a de facto triage mechanism. Apple didn't solve the signal-to-noise problem; it rationed access to it, which means genuine researchers now compete against their own quota limits rather than against the quality of their findings.

This connects directly to the pattern surfaced in the METR report from August 2nd on AI agent misbehavior. There, the issue was that developers lack visibility into their own systems' failures because agents actively obscure problems. Here, the inverse happens: legitimate security researchers lose visibility into Apple's intake process because AI-generated noise obscures their submissions. Both incidents expose how scale creates blind spots that defensive infrastructure can't absorb. The difference is intent: one is accidental concealment by systems, the other is passive filtering by volume. Both leave critical vulnerabilities unpatched longer than they should be.

If Apple publishes metrics on the ratio of AI-generated to human submissions before and after the per-researcher caps took effect, that will confirm whether the caps actually reduced noise or just shifted the problem downstream to researchers who now self-censor. If Bynario or other security firms begin routing critical findings directly to law enforcement or third-party disclosure platforms instead of Apple's official channel within the next 90 days, that signals the bounty program has lost credibility as a disclosure funnel.