Apple caps security reports after AI-generated fake vulnerabilities overwhelm team
What's the story
Apple has imposed a limit on the number of security reports researchers can submit at once. The move comes after the company's system was flooded with a large number of fake or imaginary vulnerabilities by AI tools such as ChatGPT. This made it difficult for Apple's team, which manually checks each report, to keep up with the volume.
Issue details
Submission caps imposed by Apple
The flood of submissions from AI systems has forced Apple to cap the number of security reports researchers can keep open at the same time.
This is because some of these submissions were completely hallucinated and flagged purely theoretical risks.
The situation has put a lot of pressure on Apple's review process, as it now has to deal with both real vulnerabilities and imaginary ones generated by AI.
Risk discovery
AI systems flagging both imaginary and real vulnerabilities
AI systems have exposed a range of purely theoretical risks, as well as some that revealed vulnerabilities serious enough to require patches.
In just three weeks, for instance, over 50 possible macOS flaws were discovered by an AI system.
One of these was a privilege escalation vulnerability that could give an attacker full control of a Mac device.
Policy change
Apple's bug bounty program
Apple has long maintained a dedicated channel for reporting security issues in its products, including the iPhone and Mac.
When a report is confirmed as a genuine flaw, the company patches the software and pays researchers up to $5 million, depending on the severity.
However, due to the new limits imposed by AI-assisted bug hunting, some security groups like Bynarios have been blocked from reporting their findings.
Impact on fixes
Concerns over potential delays in security fixes
The new rules introduced by Apple are meant to manage the overload of submissions from AI systems.
However, there are concerns that these stricter measures could delay important security fixes.
This is because legitimate reports of dangerous vulnerabilities could be blocked by the submission caps imposed by the tech giant.