研究者がAIのハルシネーションを大量送信したため、Appleはバグ報奨金の受付を制限
低品質なAI生成の脆弱性報告が殺到して審査パイプラインが圧迫されたことを受け、Appleはセキュリティレポートの提出を制限しました。セキュリティ研究者は真正の脆弱性をこれまでほど容易に報告できなくなり、危険なセキュリティギャップが生まれています。
apple imposed submission limits on its bug bounty program because researchers are flooding the inbox with low-quality, ai-generated reports that hallucinate vulnerabilities. bynario ceo alfredo pesoli revealed he could not report a critical macos flaw worth $100,000 to $200,000 on the black market due to these restrictions. while apple relies on ai from anthropic and openai to find bugs internally, the manual validation process is overwhelmed. this threatens the viability of traditional bug bounty programs, shifting vulnerability discovery from human crowdsourcing to automated corporate systems.