Apple is capping the number of bug reports security researchers can submit and enforcing a 30-day cooldown period, as a flood of low-quality, AI-generated reports with hallucinated vulnerabilities clogs the review pipeline, according to the Financial Times. Researchers can request a higher quota. The cap created a security gap when Italian startup Bynario used ChatGPT to find a serious macOS vulnerability that could give attackers full control over a machine but could not report it because Apple had blocked further submissions. CEO Alfredo Pesoli estimates the flaw's black-market value at $100,000 to $200,000. Apple has since reached out to Bynario. Meanwhile, Apple itself is using AI from Anthropic and OpenAI to hunt for vulnerabilities, and its latest updates included five times as many fixes as usual. Rafe Pilling of Sophos told the FT that bug bounty programs have gone from finding vulnerabilities to validating them "at machine speed."