Appleのバグ報奨金は未検証のAI報告が対象外、繰り返せば180日停止

Infeasible reports, such as reports of theoretical issues or issues discovered by AI without proper validation. ／ Reports that are incomplete or not actionable, even if you were the first to report — such as reports without a reliable way to reproduce the issue. ／ We receive many reports claiming to be about serious security or privacy issues, but that are generated by LLMs and submitted without the required proof or validation by a person. Investigating these and other ineligible reports can prevent us from acting quickly to resolve serious and critical security issues. — 報奨金の対象外となる報告の一覧、および公式が書いている背景に関する記述より

If you repeatedly submit ineligible reports — including infeasible reports about theoretical issues or those discovered by AI without proper validation — we may pause processing your reports for 180 days. Researchers with more than two paused status periods may be permanently removed from the Apple Security Bounty program. — 停止の条件と恒久除外に関する記述より

If your status in Apple Security Bounty is paused, you are ineligible for bounty rewards or credit in security advisories during this time. We will not process your reports, unless your report clearly demonstrates the security or privacy issue by capturing the applicable Target Flag or with a fully packaged virtualization of iOS or macOS. — 停止中の扱いに関する記述より

A working exploit that explains the conditions required to start the attack and the control, data, or privilege you gain by the end of the attack — or a reliable proof of concept (PoC) for the issue you’re reporting. Your report must at least include a concise, numbered list of steps required to reproduce the issue. ／ Avoid lengthy descriptions generated by AI tools. ／ Only the first complete and actionable report we receive for an issue is eligible for a reward, even if it’s not the first or only report we receive. — 報告に求められる要件、AI生成の説明文に関する注意、および報奨金の対象になる報告に関する記述より

If you repeatedly submit ineligible reports — including infeasible reports about theoretical issues or those discovered by AI without proper validation — we may pause processing your reports for 180 days. — 処理停止に関する記述より

Apple has confirmed to The Financial Times that it has “introduced a cap and a 30-day cool-off period on submissions through its internal security portal, requiring users to submit requests for an increased quota.” ／ we recently adjusted the number of new reports a researcher can have open at once. ／ The company added that researchers “can easily request an increase to that limit at any time to ensure critical reports reach our security teams.” — 上限と30日の待機、Appleの説明に関する記述より