AI uncovers Apple security flaws faster than Apple can review them

Artificial intelligence is helping security researchers discover software vulnerabilities at a much faster pace, creating a new challenge for Apple as it works to review and verify the growing number of reports. According to the Financial Times, the company has introduced a limit on how many security reports individual researchers can keep open at one time after a surge in AI-assisted submissions placed increasing pressure on its review process.

The rise of AI-powered security tools has made it easier to identify potential weaknesses in software. However, not every report represents a genuine threat. Some submissions contain only theoretical vulnerabilities, while others rest on incorrect AI-generated assumptions. Even so, many reports highlight real security issues that require immediate attention.

Apple still relies on human experts to verify every submission before deciding whether a vulnerability needs to be fixed. Although the company has started using AI to help prioritise reports, the final assessment remains a manual process. As AI continues to improve at identifying possible weaknesses, confirming which vulnerabilities pose a genuine risk has become the greater challenge.

AI accelerates vulnerability discovery

Security company Bynario has demonstrated how AI can significantly speed up the process of finding software flaws. Speaking to the Financial Times, the company said it identified more than 50 potential macOS vulnerabilities within just three weeks. Among them was a privilege escalation chain that could allow an attacker to gain complete control of a Mac.

The company’s Atlas security platform, powered by GPT-5.5, uncovered a vulnerability affecting macOS Screen Sharing. The flaw allowed an authenticated Virtual Network Computing (VNC) viewer to access protected information and create files with root-level privileges under specific conditions.

The vulnerability required Screen Sharing or Remote Management to be enabled alongside legacy VNC password authentication. Apple later assigned the issue the identifier CVE-2026-43760 and released a fix in macOS Tahoe 26.6.

Bynario also demonstrated that the vulnerability could be expanded into a working exploit capable of executing commands with root privileges. Rather than submitting a theoretical security concern, the company provided Apple with a practical proof of concept, allowing engineers to reproduce the issue more easily and develop an appropriate patch.

The example highlights how AI is becoming a valuable tool for security researchers. Instead of replacing human expertise, AI enables researchers to analyse large amounts of code more efficiently, increasing the number of vulnerabilities they can identify in a shorter period.

Apple balances speed with accuracy

While AI can rapidly generate potential attack scenarios, Apple still faces the time-consuming task of determining which reports represent genuine security risks. Every vulnerability must be reproduced, tested under the reported conditions and assessed for its potential impact before any software update can be released.

To help manage the growing workload, Apple has begun using AI in its review process to prioritise incoming reports. Even so, human verification remains essential because AI-generated findings can include false positives or unrealistic attack paths that cannot be exploited in practice.

Apple’s recent security advisories also show that AI-assisted research is already contributing to real-world security improvements. The company has credited researchers working with Claude for discovering a kernel vulnerability, while OpenAI Codex Security has assisted in identifying multiple issues affecting the WebKit browser engine.

These examples demonstrate that AI is becoming an increasingly important part of software security research. Rather than simply generating speculative reports, AI tools are now helping researchers discover vulnerabilities that ultimately lead to official security patches for macOS and Safari.

However, Apple must strike a careful balance. Restricting submissions too heavily could discourage legitimate researchers from reporting important discoveries. At the same time, accepting unlimited AI-generated reports risks overwhelming security teams with submissions that require significant effort to investigate.

Bug bounty evolves for the AI era

As AI-assisted vulnerability research becomes more common, Apple has introduced changes to its bug bounty programme to improve the quality of submitted reports. The company has placed greater emphasis on evidence that demonstrates an exploit can successfully reach protected areas of its operating systems.

Apple’s maximum bug bounty reward now exceeds US$5 million for the most serious exploit chains. The programme also includes Target Flags, which help researchers demonstrate that a vulnerability can access sensitive parts of the system rather than relying solely on theoretical analysis.

These changes are intended to help Apple’s security teams distinguish genuine security threats from AI-generated speculation. Demonstrated exploits backed by technical evidence can be reviewed more efficiently than reports describing hypothetical attack paths without proof that they can be reproduced.

For everyday Mac users, the increasing use of AI in vulnerability research reinforces the importance of installing software updates as soon as they become available. While Apple continues to improve its ability to process an increasing number of security reports, timely updates remain the most effective defence against newly discovered threats.

The rapid growth of AI-powered security research is reshaping how software vulnerabilities are discovered and reported. As AI continues to accelerate the pace of discovery, companies such as Apple will need equally advanced tools and efficient review processes to ensure genuine threats are identified and addressed without delay.