A Real $200,000 Mac Flaw Hit Apple's Anti-Slop Cap

An Italian cybersecurity startup spent three weeks running frontier AI against macOS and walked away with a privilege-escalation flaw: a bug that lets an attacker who already has a foothold on a Mac seize full control of the machine. The firm, Bynario, says the bug sits in macOS's Screen Sharing service and would fetch $100,000 to $200,000 on the black market. Then Apple's automated submission gate, designed to block AI-generated junk reports, bounced the legitimate finding before a human could read it.

According to HotHardware's coverage of the episode, the tool Bynario used was OpenAI's ChatGPT-5.5, run through the startup's own scanning pipeline. The full technical writeup lives on Bynario's own blog. The original reporting traces to a Financial Times piece that has been re-reported by Computerworld and others in parallel.

Bug-bounty programs are the corporate practice of paying outside researchers for security flaws; Apple's tops out at over $5 million for the most severe findings. When both attackers and outside researchers can use the same frontier AI to find bugs, the scarce resource in defensive security stops being discovery. It becomes triage: the human work of deciding which reports describe a real, reproducible hole in production code.

That is the work Apple's new policy is now bottlenecking.

Apple has begun limiting how many active bug reports any individual researcher can keep open at once and enforcing cooldown periods, windows during which the same researcher cannot submit new findings, for submitters who produce too many low-quality reports, according to FT-sourced coverage. The policy responds to a real flood: AI-assisted scanners can generate thousands of plausible-looking but unreproducible vulnerability reports in hours, and each one costs Apple engineer-hours to investigate. Without the cap, the triage queue drowns.

The catch is that a $100,000-to-$200,000 privilege-escalation flaw looks a lot like a low-quality report on first read. The Screen Sharing bug, a flaw in the macOS service that lets a Mac share its screen with another device on the same network, is exactly the kind of deep-system finding AI tools are good at surfacing and exactly the kind of finding that demands a human engineer to verify it can actually be reproduced on real hardware. Bynario says its submission was automatically rejected because the firm's queue had hit the artificial ceiling. Apple later reached out to manually review the report, according to The Decoder's re-reporting, and the underlying issue now sits inside Apple's own macOS Tahoe 26.6 and Sonoma 14.8.8 security advisories.

That sequence, blocked and then manually unblocked, is the irony, and it points at a deeper problem. Apple itself uses frontier models from Anthropic and OpenAI to hunt for internal weaknesses, and the company's recent software patches have carried roughly five times as many security fixes as older release cycles. Internal AI is generating real findings at scale; external AI is generating plausible noise at scale. The two streams hit the same triage inbox from opposite directions.

The blunt cap cannot tell them apart. It counts submissions and applies cooldowns. A researcher who files a $200,000 privilege-escalation bug alongside fifty AI-assisted probes looks identical to a researcher who filed fifty AI-assisted probes and no real bug. Both hit the cap. Both get the same cooldown. The mechanism Apple built to defend against the noise problem punishes the people most likely to be producing the signal.

The fix is not a softer cap. It is a different kind of triage. The bottleneck in defensive security has moved from finding bugs to believing bug reports, and any policy that treats those two activities as one will keep catching real researchers in the same net as junk. Companies running bounty programs at this scale are going to have to invest in the verification step itself: reproducible builds, sandboxed reproduction environments, and machine-checkable proof-of-concept artifacts that let a computer confirm a bug exists before a human ever has to read the email.

Apple has not commented publicly on the Bynario episode beyond the indirect acknowledgement that the firm was contacted. The Bynario bug is now patched. The policy is still in place. The next time an outside researcher uses frontier AI to find a real, deep-system flaw, the submission cap will not know the difference.