Staff Full Stack Engineer

Apple caps bug reports after AI submissions blocked $200K macOS exploit. 2026-08-04 06:43:34 Key Takeaways * Apple implemented a vulnerability report cap in June to manage overwhelming AI-generated submissions of nonexistent flaws. * Bynario discovered 50+ macOS bugs including a $100,000-$200,000 privilege escalation exploit using ChatGPT. * Apple is now reviewing Bynario's work and allowing researchers to request higher submission quotas. Apple capped the number of vulnerability reports a researcher can file simultaneously after its security team was overwhelmed by AI-generated submissions that reported nonexistent flaws, the Financial Times reported. The cap, implemented in June with a 30-day cool-off period, prevented Milan-based cybersecurity startup Bynario from reporting a privilege escalation exploit chain valued between $100,000 and $200,000 on the criminal market. The restriction reflects a broader industry challenge as AI tools enable mass vulnerability discovery, with platforms like Bugcrowd reporting submission volumes quadrupling in March and competitors HackerOne and Nextcloud suspending their paid bug bounty programs in April. Bynario discovered 50+ macOS bugs using ChatGPT. Bynario used OpenAI's ChatGPT to surface more than 50 bugs in the latest version of macOS over three weeks, according to the Financial Times. Among the discoveries was a privilege escalation exploit chain, a class of flaw that hands an attacker unrestricted control of a machine. Chief executive Alfredo Pesoli stated the exploit's value on the criminal market ranged between $100,000 and $200,000. The firm could not report the vulnerability because Apple had already refused further submissions under the new cap. Apple told the Financial Times it is now in contact with Bynario and reviewing its work. Pesoli said "maintainers and vendors have been flooded by the sheer amount of bugs" being uncovered. Apple's security portal now requires researchers to apply for a bigger quota beyond the standard cap. Every alleged flaw still needs a human to confirm it, though Apple is using AI internally to triage the pile. Apple stated it had "recently adjusted the number of new reports a researcher can have open at once" and that researchers can ask for a higher limit at any time. Bug bounty platforms suspended programs amid submission surge. In May, security firm Bugcrowd said submissions through its platform more than quadrupled across three weeks in March, with most being fake. HackerOne and Nextcloud suspended their paid programs in April, with Nextcloud stating no rewards would be paid "regardless of severity" until it found a way to filter the low-effort reports. The volume is driven by rewards on offer, with Meta, Microsoft, Apple and Crypto.com paying out at least $58 million between them in 2025. Apple's own top tier reaches $5 million for a single finding. Vietnam-based security startup Calif carried an exploit to Apple's California headquarters in person in May, saying it wanted to avoid "getting buried in the submission flood" that entrants in hacking contest Pwn2Own had been caught in. Calif had used a preview version of AI tools to build the first public macOS kernel memory corruption exploit able to survive Memory Integrity Enforcement, the defence Apple announced last September. Calif found the bugs on April 25 and had a working exploit by May 1. Bynario tried the portal three months later and could not get in. Anthropic and OpenAI tools surfaced flaws in Apple updates. In security updates last week, Apple credited Anthropic and OpenAI software with surfacing flaws, and carried roughly five times the fixes of a normal cycle, according to the Financial Times. In March, Anthropic introduced Mythos, a cyber-focused model it initially restricted to selected technology companies, banks and researchers under Project Glasswing. Mozilla said the tool surfaced 271 vulnerabilities in Firefox during internal testing. Coinkite lost over $100 million to firmware exploit. Coldcard wallet manufacturer Coinkite suggested that AI was likely used to uncover a bug in its open source firmware that sat unnoticed for five years, enabling attackers to steal more than $100 million from its hardware wallets. Two months prior, Zcash disclosed that researcher Taylor Hornby, working with Claude Opus 4.8, had found two lines of code in its Orchard shielded pool that allowed undetectable counterfeiting of ZEC for four years. Zcash rolled out the Ironwood upgrade last month to address the vulnerability. Faq. What did Apple do to address the surge in AI-generated bug reports? Apple capped the number of vulnerability reports a researcher can file simultaneously and added a 30-day cool-off period on its security portal in June. Researchers must now apply for a bigger quota beyond the standard cap, and every alleged flaw still requires human confirmation, though Apple is using AI internally to triage submissions. Why did Bynario fail to report the macOS privilege escalation exploit? Bynario discovered more than 50 macOS bugs in three weeks using ChatGPT, including a privilege escalation exploit chain valued between $100,000 and $200,000. The firm could not report the vulnerability because Apple had already refused further submissions under the new cap implemented to manage the flood of AI-generated reports. How did AI tools contribute to Apple's recent security updates? In security updates last week, Apple credited Anthropic and OpenAI software with surfacing flaws and carried roughly five times the fixes of a normal cycle, according to the Financial Times. Anthropic's Mythos model, introduced in March and initially restricted to selected technology companies and researchers, surfaced 271 vulnerabilities in Firefox during Mozilla's internal testing. Disclaimer: The information on this page may come from third-party sources and is for reference only. It does not represent the views or opinions of Gate and does not constitute any financial, investment, or legal advice. Virtual asset trading involves high risk. Please do not rely solely on the information on this page when making decisions. For details, see the Disclaimer.

Bugcrowd launches Savant Pathseeker for continuous agentic pentesting. Crowdsourced cybersecurity company Bugcrowd Inc. today launched Savant Pathseeker, an agentic penetration testing tool that continuously tests external web applications and application programming interfaces for vulnerabilities and provides proof that the flaws it finds can actually be exploited. The product is the first in a new Agentic Offensive Testing line from the company and pairs automated testing at scale with on-demand access to Bugcrowd's community of human pentesters. Bugcrowd is pitching Savant Pathseeker as a fix for a coverage gap that forces security teams to choose between depth and breadth. High-value assets can sit exposed for months between manual pentests, the company argues. Scanners watch everything else but flag theoretical flaws without confirming which are real. The company frames it as a timing problem. Attackers have turned to AI to probe continuously, and a pentest run every few months cannot keep up. The tool runs purpose-built agents against external-facing applications and APIs continuously. Findings are validated automatically and surfaced in one platform, so teams are not stuck triaging raw scanner output. Each finding comes with reproducible proof of exploitability and audit-ready reporting intended for security teams, auditors and regulators. Built-in guardrails and a manual kill switch keep testing within a customer's defined scope. The tool integrates with Bugcrowd's existing services, including its penetration testing as a service, bug bounty and vulnerability disclosure programs, red team as a service and attack surface monitoring. Customers can escalate systems that warrant deeper investigation to human researchers within the same platform. Bugcrowd positions the automated testing as a complement to its researchers rather than a replacement. The agents handle continuous baseline coverage so human experts can concentrate on business logic flaws, exploit chains and zero-day vulnerabilities that automated tools tend to miss. "Every day, our research community uncovers the next generation of critical vulnerabilities, zero-days, business logic flaws, broken access controls, that automation and AI simply can't find," said Braden Russell, chief technology officer at Bugcrowd. "We built Savant Pathseeker with our customers, designed around that human edge, bringing agentic discovery, testing, and validation into one place so every layer of offensive security works seamlessly." The company said it does not use customer or researcher data to train or tune the models behind Savant Pathseeker. The product runs on frontier AI models with a proprietary layer of skills developed by Bugcrowd's in-house practitioners. Savant Pathseeker forms part of a broader effort Bugcrowd calls Savant, which aims to combine autonomous testing, human-led engagements and attack surface visibility into a single view of exploitable risk. Chris Steffen, vice president of research at Enterprise Management Associates Inc., said in the announcement that security teams are stuck between periodic manual pentests that leave assets exposed and high-volume scanners that generate noise without proving what is exploitable. As agentic pentesting tools enter the market, he said, the real differentiator will not be automation alone but how well vendors pair machine speed with human judgment. Savant Pathseeker is available today through an early access program, with general availability planned for later this year. Image: Bugcrowd. A message from John Furrier, co-founder of SiliconANGLE: Support its mission to keep content open and free by engaging with theCUBE community. Join theCUBE's Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities. * 15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more * 11.4k+ theCUBE alumni - Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network. Are you AWS customer? Support SiliconANGLE Financially by buying your AWS services from its Marketplace portal page and links. About SiliconANGLE Media SiliconANGLE Media is a recognized leader in digital media innovation, uniting breakthrough technology, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios - with flagship locations in Silicon Valley and the New York Stock Exchange - SiliconANGLE Media operates at the intersection of media, technology and AI. Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Its new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.