AI helps find security holes — in theory. In practice, it’s currently producing so many reports that the recipients can’t keep up. Apple has now responded and pulled the emergency brake.
What Apple is changing
According to the Financial Times, Apple is introducing a cap on submitted bug reports in Feedback Assistant, plus a 30-day cool-off period. The reason: the overwhelming volume of AI-generated submissions. Anyone who wants to submit more can request a higher quota.
Apple isn’t alone here — just prominent. Similar throttles already appeared at the curl project, the Internet Bug Bounty and other open-source projects. What’s new is that, for the first time, a major company is formally limiting AI-assisted vulnerability disclosure.
The real problem
The idea sounds good: an AI model scans code, finds a bug, writes a report. The problem is the hit rate. Many of these auto-generated reports are plausibly worded but factually wrong — hallucinated holes in polished jargon. For the teams that have to review every report, that’s poison. Real reports drown in the noise, and the scarce time of security people evaporates.
My take
This is one of those unintended side effects that show how quickly AI pushes into established workflows. Vulnerability disclosure runs on trust and signal quality — and both erode when anyone can fire off a thousand half-baked reports with a few clicks. Apple’s answer is understandable, but it treats the symptom, not the cause. More interesting would be the reverse move: AI that vets and filters incoming reports before a human sees them, instead of just producing them. The same tech that creates the problem could also solve it. Until then: a tool is only as useful as the discipline with which you use it.
Sources: