Apple’s security team is grappling with a wild new challenge: an overwhelming ‘AI Bug Flood’ of fake vulnerability reports. This isn’t just a minor annoyance; it’s highkey creating a critical backlog, leaving actual, dangerous macOS exploits on the table. According to reports from the Financial Times, this deluge forced Apple to cap the number of bug reports a researcher can submit, a move that already cost them one seriously valuable exploit.
Take Bynario, a cybersecurity startup out of Milan. These dudes leveraged OpenAI’s ChatGPT and, in just three weeks, surfaced over 50 bugs in macOS, including a legit privilege escalation exploit chain. This kind of flaw, giving an attacker unrestricted control, is no cap, serious business. Yet, Bynario couldn’t report it due to Apple’s new cap. Alfredo Pesoli, Bynario’s chief executive, pegged the exploit’s value at a cool $100,000 to $200,000 on the criminal market.
Apple confirmed to the FT it ‘recently adjusted’ its policy and allows researchers to request higher limits. The company is also reportedly using AI internally to triage the massive influx of reports, an ironic twist given the problem’s source. This isn’t just an Apple problem; other prominent platforms like Bugcrowd, HackerOne, and Nextcloud have been inundated. Bugcrowd, whose clients include OpenAI, saw submissions quadruple in March, with most being fake, forcing some programs to pause payouts.
What makes this situation particularly interesting, or maybe ‘sketchy,’ is AI’s dual role. While it’s flooding systems with junk, advanced AI models are also getting seriously good at finding legitimate bugs. Last week, Apple’s own security updates even credited software from Anthropic and OpenAI for helping surface flaws, resulting in about five times the usual number of fixes. This highlights the paradox: AI is both the problem and a potential solution, but distinguishing the ‘dope’ AI-found bugs from the ‘dud’ AI-generated noise is the real challenge.
The capabilities of these AI tools are evolving at a rapid clip, for real. Anthropic introduced Mythos, a cyber-focused model initially restricted to select tech companies and researchers. Mozilla reported Mythos surfaced 271 vulnerabilities in Firefox during internal testing. Then there’s Calif, a security startup, which, according to the article, used a preview version of Mythos to build the first public macOS kernel memory corruption exploit able to bypass Apple’s Memory Integrity Enforcement. Calif delivered findings in person to avoid ‘getting buried in the submission flood,’ a move that hits different after Bynario’s experience.
Beyond operating systems, AI is also being utilized for nefarious purposes in the crypto world. Coldcard wallet manufacturer Coinkite, as stated, suspects AI uncovered a five-year-old bug in its firmware, leading to over $100 million in stolen funds. This incident, along with Zcash’s disclosure of a counterfeiting vulnerability discovered with the help of Claude Opus 4.8, really underscores the high stakes. It’s not just about managing bug reports; it’s about a looming threat where AI can both protect and powerfully exploit, periodt.
If you enjoyed this article, share it with your friends or leave us a comment!
Darius Zerin specializes in business strategy, entrepreneurship, and market trends. He covers everything from startups to global finance, offering practical insights and forward-thinking analysis. His writing is designed to help readers stay ahead in a constantly evolving economic landscape.
