Apple's bug bounty caps make sense once you count the AI-generated reports

Apple capped how many open vulnerability reports a single researcher can hold, with a 30-day cool-off once the limit is hit, citing "the growing volume of AI-generated security submissions across the industry." The context: macOS Tahoe 26.6 and iOS 26.6 shipped a record number of patches last month, with an unprecedented share credited to Claude, Codex, and other AI tools. Read together, Apple's recent bounty changes stop looking arbitrary. Automated vulnerability discovery is producing real findings faster than any triage team can absorb, and rate-limiting the submitters is the crude available lever.

View full digest for August 7, 2026