Apple struggles to keep pace with AI-powered bug hunters as vulnerability reports flood in

Apple has raised its top Security Bounty payout to $2 million as of November 2025, with individual payouts potentially exceeding $5 million, in response to a flood of AI-generated vulnerability reports that are straining its bug bounty program. The company has also expanded bounty categories and introduced a flagging mechanism to speed validation, having paid over $35 million to more than 800 researchers since the program's launch. According to the Financial Times, the surge in AI-assisted reports is an industry-wide challenge for corporate bug bounty programs.

Via getstealery.com Apple struggles to keep pace with AI-powered bug hunters as vulnerability reports flood in The iPhone maker has raised its top bounty payout to $2 million and introduced new triage systems, but the flood of AI-generated security reports is straining even the world's richest tech company. Apple’s security team has a new adversary, and it’s not a shadowy hacking group. It’s the sheer volume of vulnerability reports generated by researchers wielding AI tools, a problem the Financial Times calls a growing crisis for corporate bug bounty programs. As of November 2025, Apple raised its top Security Bounty payout to $2 million for sophisticated zero-click exploit chains. With potential bonuses, individual payouts can exceed $5 million. Apple has also expanded its bounty categories and rolled out a systematic flagging mechanism designed to speed up the validation process. Since launching its bounty program, Apple has paid out more than $35 million to over 800 researchers. The same large language models that help skilled researchers automate tedious parts of vulnerability analysis also let less skilled operators blast out hundreds of superficially plausible but ultimately useless reports. Bug bounty administrators now face a triage nightmare. Every submission needs human review to determine if it’s a genuine zero-day or just an AI hallucination dressed up in technical jargon. This isn’t unique to Apple. The FT’s reporting suggests it’s an industry-wide phenomenon affecting corporate bounty programs broadly. AI tools are genuinely accelerating the discovery of complex vulnerabilities. But the operational burden of processing AI-assisted findings is threatening to overwhelm the very programs designed to incentivize that discovery. Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy https://cryptobriefing.com/editorial-policy/ .