Apple AI bug-report cap

On 2 August 2026 Apple introduced a quota that limits the number of open macOS security‑bug reports each researcher can maintain, adding a 30‑day reflection period. The move responded to an influx of AI‑generated submissions, many of which were speculative or hallucinated. Italian startup Bynario used tools such as ChatGPT and GPT‑5.5 to file more than 50 potential macOS flaws in three weeks, including a privilege‑escalation chain (CVE‑2026‑43760) that was patched in macOS Tahoe 26.6. Apple now triages reports with AI but requires human verification, and the bug‑bounty program has been restructured with payouts that can exceed $5 million for critical exploits. Researchers may request higher limits for high‑impact findings.

The following day Mozilla released patches for a high‑severity remote‑code‑execution bug in the SpiderMonkey engine (CVE‑2026‑10702) in Firefox 151.0.3 (2 June 2026) and Tor Browser 15.0.19 (20 July 2026). Mozilla’s notes referenced Apple’s new reporting limits and noted that Bynario’s submissions were blocked. Both companies urged users to update their software promptly.