苹果限制单名研究人员可同时提交的漏洞报告数量

The Odaily Planet Daily reports that Apple has restricted the number of vulnerability reports a single researcher can submit simultaneously, citing a large volume of AI-generated submissions that contained no actual flaws. Apple stated that researchers can request a higher limit at any time, and the company is also using AI internally to triage incoming submissions.

Bynario, a Milan-based cybersecurity startup, said it used OpenAI's ChatGPT to discover over 50 vulnerabilities in the latest version of macOS within three weeks, including a privilege escalation chain that could grant attackers full control of a Mac device.

Bynario noted that it was unable to report the vulnerability because Apple had already rejected further submissions. Bynario CEO Alfredo Pesoli estimated the vulnerability's value on the criminal market at $100,000 to $200,000. Apple said it has contacted the company and reviewed its work. In June, Apple introduced submission limits and a 30-day cooldown period for its security portal. In a recent security update, Apple listed vulnerabilities found with the assistance of Anthropic and OpenAI software, with the number of fixes roughly five times that of a normal cycle. (Decrypt)