When Italian cybersecurity startup Bynario submitted its fifty-plus security findings to Apple last month, its Atlas platform — powered by OpenAI's GPT-5.5 — was doing exactly what Apple's bounty program is designed to incentivize: finding real, exploitable vulnerabilities and bringing them to the vendor before attackers could. But Bynario had submitted too many reports, too quickly. Apple's new submission cap had kicked in. When the company then discovered CVE-2026-43760 — a macOS Screen Sharing flaw that allowed a VNC-authenticated viewer to read protected files and execute commands with root privileges — there was no way to file it through normal channels. Rather than wait out the 30-day cool-off period, Bynario CEO Alfredo Pesoli chose to go public, estimating the flaw's black-market value at $100,000 to $200,000, according to Apple's cap story coverage.

That decision — to publish rather than wait — produced the precise outcome that coordinated vulnerability disclosure was designed to prevent: an unpatched critical flaw disclosed before the vendor had a chance to act. Apple subsequently reached out to Bynario and patched CVE-2026-43760 in macOS Tahoe 26.6, as confirmed by Apple's Tahoe 26.6 advisory, but the episode exposed a structural problem that no bounty program payout table can solve. Volume throttles are blunt instruments. They cannot tell the difference between an AI-slop generator firing off hundreds of hallucinated vulnerability claims and a prolific, legitimate researcher using AI to validate and document dozens of real ones. Apple's cap catches both.

How Did a Critical Flaw End Up Disclosed Outside Apple's Pipeline?

The answer begins with the nature of the flaw itself. CVE-2026-43760 lived in a legacy code path inside macOS Screen Sharing's VNC password authentication system — a component maintained for backward compatibility with older VNC clients that use password-only authentication rather than full macOS credentials. When Bynario's researchers investigated this path, they found that an authenticated VNC viewer could read protected files outside its authorized scope, then extended that primitive into a working post-authentication exploit capable of running commands with root privileges, as detailed in Bynario's CVE-2026-43760 write-up, a finding also reported by Digital Trends' Apple security coverage.

What makes the flaw technically notable is what it bypassed. Apple's Memory Integrity Enforcement (MIE) — its always-on hardware memory-safety protection designed to block exploit chains from sophisticated adversaries — did not cover this attack path. Bynario's blog described the exploit as operating "without memory corruption and beyond MIE's threat model." Apple's fix, per its security advisory, addressed the issue through improved state management in the Screen Sharing server component.

The flaw required Screen Sharing or Remote Management to be enabled and legacy VNC password access to be configured — conditions that do not apply to every Mac, but that are common in small businesses, remote-access setups, and enterprise environments running older VNC clients. Users who have not updated to macOS Tahoe 26.6 or macOS Sonoma 14.8.8 remain exposed.

When Throttles Break the Disclosure Norm

Apple's statement on the cap was brief and careful: "With the growing volume of AI-generated security submissions across the industry, we recently adjusted the number of new reports a researcher can have open at once," as reported by HNGN citing Apple's statement. Researchers who hit the ceiling can apply for a higher quota; those who exceed the limit face a 30-day waiting period before filing again. The specific cap figure has not been disclosed.

The Bynario case illustrates the core design tension with any rate limit applied to a trust-based system: the limit cannot distinguish between the two populations it needs to treat differently. AI-slop generators and AI-assisted legitimate researchers look identical from a submission-volume perspective. Both produce high numbers of reports. The difference is that slop generators produce unverified claims dressed in technical language, while AI-assisted legitimate researchers produce claims that, like CVE-2026-43760, come with working proof-of-concept exploits that Apple's own engineers can reproduce and patch.

Rafe Pilling, a security researcher at Sophos, framed the structural shift: bug bounty programs have migrated from finding vulnerabilities to validating them "at machine speed," according to the Sophos bug bounties analysis. That characterization is accurate, but it describes a problem that a simple submission cap does not solve — it merely relocates. When a legitimate researcher cannot submit through the portal, the bottleneck moves from Apple's triage queue to the researcher's inbox, and the clock on coordinated disclosure starts running in the wrong direction.

Apple Uses AI to Find Bugs Internally — and Doesn't Trust Externally Submitted AI Research

The sharpest irony in Apple's position is a structural asymmetry it has chosen not to publicly address. While the company has restricted external AI-assisted reports, it has simultaneously deployed AI tools from Anthropic and OpenAI internally to hunt for vulnerabilities in its own code. Apple said this internal AI program contributed to its most recent software updates containing roughly five times the usual number of security fixes, a claim reported alongside Apple's bug bounty cap coverage.

Apple joined Anthropic's Project Glasswing in April 2026 — a $100 million initiative that provided a coalition of technology companies, including Apple, Microsoft, Google, Amazon Web Services, Cisco, and others, early access to Claude Mythos Preview, Anthropic's unreleased frontier model, specifically for internal vulnerability hunting. Within the first month, Glasswing partners collectively identified more than 10,000 high- or critical-severity vulnerabilities across their software, per TechTimes' Glasswing coverage.

The distinction Apple draws — trusting AI pipelines it controls, distrusting AI-assisted reports it cannot verify — is defensible in principle. Apple can apply consistent quality standards to its own internal pipeline; it cannot apply the same standards to the thousands of external researchers submitting to its Feedback Assistant portal. But the practical consequence of that asymmetry is visible in the Bynario case: a startup whose AI-assisted research produced a working, patchable critical exploit was treated identically to the slop generators whose hallucinated reports fill Apple's triage queue, because the only signal available to the cap mechanism was volume.

What the Industry Has Already Tried

Apple is not operating without precedent. At least four major bug bounty platforms or programs restructured, suspended, or narrowed their scope in 2026 under the same pressure, each reaching a different conclusion about which tool to reach for.

Daniel Stenberg, the creator and lead maintainer of curl, eliminated monetary rewards entirely at the end of January 2026, after the program's confirmed-vulnerability rate fell from more than 15 percent to below 5 percent — meaning more than 19 in 20 submissions were invalid, as Stenberg documented in his curl bug bounty shutdown post. The outcome was instructive: by April 2026, the program's confirmed-vulnerability rate had recovered to 15 to 16 percent, with nearly every submission appearing AI-assisted but most now validated before filing. Removing the financial incentive filtered out the opportunistic noise while leaving motivated researchers unaffected.

GitHub took a different path, cutting public payout rates by at least 50 percent on July 27, 2026, and creating an invite-only VIP tier for researchers with demonstrated track records. The theory: reducing financial incentives at the entry level should reduce speculative slop submissions, while preserving high rewards for serious researchers who earn their way into the VIP tier.

Bugcrowd introduced mandatory identity verification, a 30-day suspension for accounts submitting 10 or more consecutive invalid reports, and permanent bans for submission farming. HackerOne launched an AI-based triage system, dubbed HackerOne's Hai Triage launch, designed to detect duplicate and likely-invalid submissions before they reached human analysts.

Apple's tool — a submission cap with a cool-off period and an exception-request process — is the least precise of these approaches and the one most likely to produce the false-positive problem the Bynario case illustrates.

Target Flags: A Better Verification Mechanism

Alongside the submission cap, Apple has deployed a more architecturally sound quality-control tool: target flags, announced in October 2025 and active since November. Inspired by capture-the-flag competitions, target flags are verification markers embedded in Apple's operating systems. When a researcher's exploit captures a target flag, it proves they have achieved a defined level of system access — register control, arbitrary read/write, or code execution — in a form that Apple can programmatically verify, as described in Apple's target flags announcement. Apple rewards target-flag submissions immediately upon validation rather than waiting months for a patch to ship — a meaningful change for researchers who have historically waited long periods for payout confirmation.

The gap between target flags and the submission cap points to a coherent internal logic Apple has not yet fully articulated publicly. Target flags filter by quality of evidence, not by volume of submissions. A researcher who submits 60 reports in three weeks but captures target flags on each one is providing better evidence of legitimate, validated research than a researcher who submits three reports with no proof of exploitability. If Apple's quality-control goal is to separate validated research from slop, target flags are a more precise instrument than submission counts — though the two mechanisms are not mutually exclusive.

Does AI-Assisted Bug Discovery Actually Create More Exploited Vulnerabilities?

The premise behind Apple's throttle — that AI-generated reports represent a qualitatively different risk than conventional research — is worth examining against the data. According to VulnCheck's H1 2026 exploitation report, of 1,061 vulnerabilities attributed to AI-assisted discovery, 14 were confirmed as exploited in the wild, a rate of approximately 1.3 percent. That rate is roughly consistent with the exploitation rate across all vulnerabilities in the same period — meaning AI-discovered vulnerabilities were not, by this measure, more dangerous or more quickly weaponized than conventionally discovered ones.

Patrick Garrity, the VulnCheck researcher who authored the report, noted that Anthropic's Project Glasswing disclosed more than 23,000 findings, of which 126 resulted in published CVEs and one was confirmed exploited in the wild — a ratio that suggests the challenge for Apple and its peers is not that AI-found bugs are inherently more dangerous, but that the sheer volume of AI-assisted submissions strains the human triage infrastructure that validates them.

This is the paradox Ross McKerchar and Ryan Westman of Sophos identified in their June 2026 Sophos bug bounty landscape analysis: "On one side, the rise of AI-assisted research has flooded many programs with low-signal 'slop.' On the other, frontier models are starting to produce validated, reproducible, exploitable vulnerabilities at machine speed. Both trends are accelerating, and neither is going to reverse." Both Bynario's CVE-2026-43760 and the hallucinated reports surrounding it are products of the same trend. The industry's challenge is building filters that separate them.

What Apple's Cap Means for Security Researchers and Mac Users

For independent security researchers who use AI to scale and validate their work, Apple's cap creates a real constraint. A researcher who finds vulnerabilities efficiently — and Bynario's three-week, 50-report pace suggests the startup was doing exactly that — now faces a ceiling that is unrelated to the quality of their findings. The exception-request process Apple has offered provides a potential path around the cap, but it introduces a gatekeeping layer that the pre-cap system did not require.

For Mac users, the immediate practical concern is ensuring they are running macOS Tahoe 26.6, which patches CVE-2026-43760. Users with macOS Sonoma 14.8.8 are also protected; the fix was backported. If Screen Sharing is not needed, disabling it in System Settings → General → Sharing eliminates the attack surface entirely. If Screen Sharing is needed, disabling the legacy VNC password option — using only macOS user account authentication for remote access — removes the specific code path the vulnerability exploited.

The longer-term question Apple has not publicly answered is whether the submission cap, as calibrated, will be adjusted in light of the Bynario case. The company reached out to Bynario directly after the Financial Times story ran, suggesting it recognized the unintended consequence. Whether that outreach translates to a structural change in how the cap interacts with prolific legitimate researchers remains to be seen.

---

Frequently Asked Questions

What is Apple's bug bounty submission cap, and how does it work?

Apple introduced a limit, in June 2026, on how many security bug reports a researcher can have open at once through its Feedback Assistant security portal. Researchers who reach the cap face a 30-day waiting period before filing again. Apple has not disclosed the specific cap figure. Researchers who need a higher quota can apply to Apple directly for an exception. The cap was introduced in response to a surge in AI-generated vulnerability reports that were overwhelming Apple's security review team.

What is CVE-2026-43760, and has it been patched?

CVE-2026-43760 is a vulnerability in macOS Screen Sharing's legacy VNC password authentication path. When Screen Sharing or Remote Management was enabled with legacy VNC password access configured, an authenticated VNC viewer could read protected files outside its authorized scope; researchers at Bynario extended this primitive into a working exploit that executes commands with root privileges. Apple patched the vulnerability in macOS Tahoe 26.6 and macOS Sonoma 14.8.8. Users who have not updated to either release should do so immediately. If Screen Sharing is not needed, disabling it removes the attack surface entirely.

Why can't Apple just use its internal AI to triage external bug reports instead of capping them?

Apple has deployed AI tools internally to hunt for vulnerabilities in its own code, and that program reportedly contributed to roughly five times the usual number of security fixes in recent updates. Applying the same pipeline to external submissions is architecturally more complicated: internal AI operates on Apple's own source code under controlled conditions, while external bug reports arrive in unstructured natural language from researchers with varying skill levels, describing vulnerabilities Apple's engineers must be able to reproduce independently. The target flag mechanism — which requires researchers to demonstrate exploitation rather than merely describe it — represents a more precise approach to this problem than volume throttles alone.

What should security researchers know about submitting AI-assisted vulnerability research to Apple?

Apple has made clear it welcomes AI-assisted security research and uses it internally. The submission cap applies to open reports, not to all research. Researchers who use Apple's target flag mechanism — which requires demonstrating actual exploit reach in the device's system — receive immediate bounty award notification upon validation, rather than waiting for a patch to ship. The target flag approach is more likely to distinguish AI-validated legitimate findings from AI-hallucinated reports than submission volume alone. Researchers who need to exceed the submission cap can apply for a higher quota directly from Apple.