Apple has capped the number of security reports researchers can keep open at once after AI bug hunting put its review process under pressure, according to the Financial Times.
Some submissions describe hallucinated or purely theoretical risks. Others uncover vulnerabilities serious enough to require patches. Bynario told the FT that it found more than 50 possible macOS flaws in three weeks, including a privilege-escalation chain that could give an attacker full control of a Mac.
Every report still needs human verification, although Apple is now using AI to help triage the backlog. Finding possible weaknesses is getting easier. Working out which ones pose an immediate threat has become the harder job.
How real are the AI-found flaws
Bynario has already shown that its system can produce more than automated guesswork. Its Atlas platform used GPT-5.5 to uncover a macOS Screen Sharing flaw that let an authenticated VNC viewer access protected data and create files with root privileges.
Unsplash
The attack required Screen Sharing or Remote Management to be enabled, along with legacy VNC password access. Apple assigned it CVE-2026-43760 and patched it in macOS Tahoe 26.6.
Bynario also demonstrated how the flaw could be extended to run commands as root. That gave Apple a working exploit to investigate rather than another vague warning generated from a code scan.
Why Apple needs the same AI
Apple’s recent security advisories credit researchers working with Claude for a kernel vulnerability. OpenAI Codex Security has also helped identify several WebKit issues.
AI-assisted research is already contributing to fixes shipped for macOS and Safari. Restricting submissions too aggressively could delay useful discoveries, while leaving the gates open risks burying Apple’s team under convincing-looking nonsense.
Pete Linforth / Pixabay
The bottleneck is verification. Models can generate possible attack paths quickly, but Apple still has to reproduce the behavior, confirm the required conditions and decide how urgently it needs a fix.
Can Apple keep the signal
Apple has redesigned its bug bounty program around stronger evidence. Its maximum payout now exceeds $5 million for the most serious exploit chains, while Target Flags help researchers prove that a flaw reaches protected parts of the system.
That gives Apple a better way to separate demonstrated exploits from automated speculation. Mac users can’t solve the reporting backlog, but they can limit their exposure by installing security updates promptly. AI bug hunting is already finding flaws that reach Apple’s patch queue.
