{"slug": "apple-s-ai-slop-problem-left-a-200k-macos-exploit-unreported", "title": "Apple's AI Slop Problem Left a $200K macOS Exploit Unreported", "summary": "Apple has capped the number of vulnerability reports a researcher can file at once after being swamped by AI-generated submissions, a move that prevented Milan-based cybersecurity startup Bynario from reporting a macOS privilege escalation exploit chain valued at $100,000 to $200,000 on the criminal market. Bynario CEO Alfredo Pesoli said the exploit could hand an attacker full control of a Mac, and Apple told the Financial Times it is now in contact with the firm and reviewing its work. Apple's security updates last week carried roughly five times the fixes of a normal cycle, with credit given to Anthropic and OpenAI software.", "body_md": "#### In brief\n\n- Apple has limited how many bug reports a researcher can have open at once after a surge of AI-generated submissions.\n- Bynario says it found more than 50 macOS bugs in three weeks, including a chain that could hand an attacker full control of a Mac.\n- Apple's security updates this week carried around five times as many fixes as previous cycles.\n\nApple has capped how many vulnerability reports a researcher can file at once, after its security team was swamped by AI-generated submissions that invent flaws that do not exist, the *Financial Times* [reported](https://www.ft.com/content/4532122d-90f2-4433-9df6-ca99d8a141d2).\n\nThe cap has already cost it a real one. Milan-based cybersecurity startup Bynario told the paper it used OpenAI's ChatGPT to surface more than 50 bugs in the latest version of macOS over three weeks. Among them was a privilege escalation exploit chain, a class of flaw that hands an attacker unrestricted control of a machine.\n\nBynario could not report it, because Apple had already refused further submissions. Chief executive Alfredo Pesoli put the exploit's value on the criminal market at between $100,000 and $200,000, and said \"maintainers and vendors have been flooded by the sheer amount of bugs\" being uncovered. Apple told the *FT* it is now in contact with the firm and reviewing its work.\n\nApple moved in June, adding a cap and a 30-day cool-off period on its security portal, with researchers required to apply for a bigger quota. Every alleged flaw still needs a human to confirm it, though Apple is using AI internally to triage the pile. Apple said it had \"recently adjusted the number of new reports a researcher can have open at once,\" and that researchers can ask for a higher limit at any time.\n\nThe same tools are working for Apple. In security updates last week, it [credited](https://9to5mac.com/2026/07/27/claude-codex-and-other-ai-tools-credited-in-todays-apple-security-releases/) Anthropic and OpenAI software with surfacing flaws, and carried roughly five times the fixes of a normal cycle, according to the *FT*.\n\n## A “submission flood”\n\nThe issue of AI bug reporting volume has [grown](https://decrypt.co/368309/ai-slop-floods-bug-bounty-programs-fake-reports) in recent months. In May, security firm Bugcrowd, whose clients include OpenAI, [said](https://decrypt.co/368309/ai-slop-floods-bug-bounty-programs-fake-reports) submissions through its platform more than quadrupled across three weeks in March, and that most were fake. [HackerOne](https://www.infoworld.com/article/4154210/internet-bug-bounty-program-hits-pause-on-payouts.html) and [Nextcloud](https://hackerone.com/nextcloud?type=team) suspended their paid programs in April, with Nextcloud saying no rewards would be paid \"regardless of severity\" until it found a way to filter the low-effort reports.\n\nThe volume is driven by the rewards on offer, with Meta, Microsoft, Apple and Crypto.com paying out at least $58 million between them in 2025, while Apple's own top tier reaches $5 million for a single finding.\n\nAt the same time, LLMs are becoming increasingly adept at spotting bugs. In March, Anthropic introduced Mythos, a cyber-focused model it [initially restricted](https://decrypt.co/369725/anthropic-expands-access-claude-mythos-ai-giant-files-ipo-1) to selected technology companies, banks and researchers under Project Glasswing. Mozilla said it surfaced [271 vulnerabilities in Firefox](https://decrypt.co/365099/anthropic-claude-mythos-ai-271-vulnerabilities-firefox-seriously-powerful) during internal testing.\n\nIn May, Vietnam-based security startup Calif said it had used a preview version to build the [first public macOS kernel memory corruption exploit](https://decrypt.co/367925/apple-mac-m5-system-exploited-anthropic-claude-mythos-ai) able to survive Memory Integrity Enforcement, the defence Apple [announced](https://security.apple.com/blog/memory-integrity-enforcement/) last September as the biggest memory safety upgrade in the history of consumer operating systems. Calif found the bugs on April 25 and had a working exploit by May 1.\n\nInstead of filing a report, Calif carried the exploit to Apple's California headquarters in person, saying it wanted to avoid \"getting buried in the submission flood\" that entrants in hacking contest Pwn2Own had been caught in. Bynario tried the portal three months later and could not get in.\n\n## AI crypto threats\n\nAs well as hunting down threats, AI is also being used to engineer exploits in the crypto space. Coldcard wallet manufacturer Coinkite has [suggested](https://decrypt.co/374766/38m-in-bitcoin-drained-by-coldcard-key-flaw-its-maker-thinks-ai-found) that AI was likely used to uncover a bug in its open source firmware that sat unnoticed for five years, enabling attackers to steal [more than $100 million](https://decrypt.co/374891/hardware-wallet-firms-warn-of-phishing-surge-as-coldcard-losses-near-130m/) from its hardware wallets.\n\nIt comes two months after Zcash disclosed that researcher Taylor Hornby, [working with Claude Opus 4.8](https://decrypt.co/370237/ai-discover-tech-vulnerabilities-zcash-latest-example), had found two lines of code in its Orchard shielded pool that allowed undetectable counterfeiting of ZEC for four years—prompting the privacy coin to roll out the [Ironwood upgrade](https://decrypt.co/374577/zcash-ironwood-upgrade-counterfeiting-scare) last month to address the vulnerability.", "url": "https://wpnews.pro/news/apple-s-ai-slop-problem-left-a-200k-macos-exploit-unreported", "canonical_source": "https://decrypt.co/374900/apples-ai-slop-problem-left-a-200k-macos-exploit-unreported", "published_at": "2026-08-04 13:36:06+00:00", "updated_at": "2026-08-04 13:45:06.593585+00:00", "lang": "en", "topics": ["ai-tools", "ai-safety", "ai-policy"], "entities": ["Apple", "Bynario", "OpenAI", "Anthropic", "Financial Times", "Alfredo Pesoli", "Bugcrowd", "HackerOne"], "alternates": {"html": "https://wpnews.pro/news/apple-s-ai-slop-problem-left-a-200k-macos-exploit-unreported", "markdown": "https://wpnews.pro/news/apple-s-ai-slop-problem-left-a-200k-macos-exploit-unreported.md", "text": "https://wpnews.pro/news/apple-s-ai-slop-problem-left-a-200k-macos-exploit-unreported.txt", "jsonld": "https://wpnews.pro/news/apple-s-ai-slop-problem-left-a-200k-macos-exploit-unreported.jsonld"}}