Apple has updated its internal bug reporting portal to cap how many open reports a single security researcher can have at once, following a surge in AI-generated submissions that flag non-existent flaws. The company told the Financial Times the change was made quietly in June, and researchers who hit the limit face a 30-day cooling-off period before filing again. Apple said in a statement that “with the growing volume of AI-generated security submissions across the industry, we recently adjusted the number of new reports a researcher can have open at once,” adding that researchers “can easily request an increase to that limit at any time to ensure critical reports reach our security teams.” The new limits already affected Italian cybersecurity startup Bynario, which used OpenAI’s ChatGPT to identify more than 50 potential bugs in the newest version of macOS over three weeks, including a privilege escalation exploit that could give an attacker full control of a Mac. Bynario initially could not file the report because it had maxed out its count; Apple says it is now talking to Bynario directly. Apple also uses AI internally to sort incoming reports, crediting models from Anthropic and OpenAI for surfacing real vulnerabilities patched in its latest software updates.