iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Apple’s bug bounty update raises the top Security Bounty reward to $2 million for a qualifying no-user-interaction network exploit chain that reaches the kernel, while conditional bonuses can push a theoretical award above $5 million. Apple reported paying more than $35 million to over 800 researchers as of October 10, 2025—not as a verified August 2026 total.
The overhaul, announced on October 10, 2025, expanded reward categories, introduced Target Flags for demonstrating specific security outcomes, and added accelerated awards for some qualifying submissions. Apple said the revised program would take effect in November 2025.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
iOS Hacker's Handbook: Mastering Security Research, Exploitation, and Reverse Engineering on Apple... | $3.99 | Buy on Amazon |
Key takeaways
- Apple’s current maximum base reward is $2 million for a no-user-interaction network attack that reaches the kernel.
- Apple says conditional Lockdown Mode and beta-software bonuses can push a qualifying award above $5 million, but that is a theoretical, highly difficult ceiling rather than a standard payout.
- Apple reported paying more than $35 million to more than 800 researchers since its public program began in 2020, with that figure dated to October 10, 2025.
- The reward depends on the demonstrated endpoint and attack path: a kernel compromise can qualify for substantially more than user-space execution, a sandbox escape, or a browser code-execution issue.
- Reports must be complete, actionable, reproducible, directly submitted, undisclosed, and relevant to current Apple software or hardware in a standard configuration.
What changed in Apple’s bug bounty update?
Apple’s October 2025 bug bounty update redesigned the Security Bounty program around complete exploit chains and attacks resembling sophisticated real-world or mercenary-spyware campaigns. The changes included higher maximum rewards, expanded product and service categories, Target Flags for objective exploitability demonstrations, and accelerated awards for some qualifying reports.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Apple announced that the new payouts and categories would take effect in November 2025. The company linked the changes to the increasing sophistication and development cost of targeted attacks, while noting that defenses such as Lockdown Mode and Memory Integrity Enforcement make advanced exploitation more difficult. Those explanations are Apple’s stated rationale, not an independently verified measurement of the exploit market.
#1 Best Overall
Apple also described the top reward as the largest in the industry, but that is an Apple claim rather than an independently verified industry-wide ranking. The practical change is clearer: the program now places more financial weight on proving a complete, high-impact attack path.
How much is Apple’s top bug bounty?
Apple’s current top base reward is $2 million. The $2 million maximum applies to a narrowly defined outcome: a network attack requiring no user interaction that reaches the kernel. Finding an isolated vulnerability, triggering a crash, or obtaining user-space code execution does not automatically qualify for $2 million.
The current Apple reward categories show how the endpoint changes the potential award:
| Attack path | Demonstrated endpoint | Maximum reward |
|---|---|---|
| Network attack with no user interaction | Kernel | $2,000,000 |
| Network attack with no user interaction | User space | $350,000 |
| Network attack requiring user interaction | Kernel | $1,000,000 |
| Wireless proximity attack against Apple-designed radio components | Application processor | $1,000,000 |
| Unauthorized physical access to a locked device | Sensitive user data | $500,000 |
| App sandbox escape | Kernel | $500,000 |
| App sandbox escape | Sensitive user data | $100,000 |
| Browser attack | Kernel | $1,000,000 |
| Browser attack | WebContent sandbox escape | $300,000 |
| Browser attack | WebContent code execution | $10,000 |
The table illustrates Apple’s outcome-based approach. A browser vulnerability that achieves WebContent code execution is not valued like a browser exploit chain that escapes the sandbox and reaches the kernel. The vulnerability class matters, but the demonstrated security boundary crossed and final impact matter more.
How did Apple’s maximum rewards change?
Apple’s October 2025 announcement compared selected previous and revised maximums. Apple doubled the advertised maximum for a zero-click remote exploit chain, but Apple did not double every category:
| Category | Previous maximum | New maximum | Change |
|---|---|---|---|
| Zero-click remote exploit chain | $1,000,000 | $2,000,000 | Doubled |
| One-click remote exploit chain | $250,000 | $1,000,000 | Increased fourfold |
| Wireless proximity attack | $250,000 | $1,000,000 | Increased fourfold |
| Physical access to a locked device | $250,000 | $500,000 | Doubled |
| App sandbox escape to an SPTM bypass | $150,000 | $500,000 | Increased substantially |
These are category ceilings, not guaranteed payments. A report must still satisfy Apple’s eligibility rules and demonstrate the required endpoint. Apple’s announcement of the Security Bounty redesign provides the historical comparison.
Can an Apple bug bounty exceed $5 million?
Apple says conditional bonuses can take a qualifying $2 million base award to more than $5 million. The most significant published bonus pathways are a 100% bonus for vulnerabilities that bypass specified Lockdown Mode protections and a 50% bonus for qualifying issues unique to newly added beta code or features, including a newly introduced regression, when reported before the beta period ends.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The bonuses are conditional and category-dependent. They do not mean that every $2 million exploit becomes a $5 million payout. Apple characterizes a $5 million award as theoretically possible but extremely difficult and unlikely. Lockdown Mode bonuses also do not apply to Private Cloud Compute.
The Apple Security Bounty guidelines should be treated as the controlling source for bonus conditions, because Apple can change reward amounts and eligibility requirements over time.
What other Apple bounty categories expanded?
The redesigned program added or increased rewards for several specific outcomes beyond the top zero-click kernel category:
- A one-click WebKit attack that achieves a sandbox escape can qualify for up to $300,000.
- A chain that continues from the browser to unsigned code execution with arbitrary entitlements can qualify for up to $1 million.
- Unauthorized access to iCloud account data on Apple servers can qualify for up to $1 million.
- Certain wireless proximity attacks can qualify for up to $1 million.
- A complete Gatekeeper bypass requiring no user interaction can qualify for up to $100,000.
- Some low-impact issues that Apple fixes out of caution and credits with a CVE can receive a $1,000 reward.
Apple specifically highlighted macOS Gatekeeper because the company had not received a report demonstrating a complete Gatekeeper bypass without user interaction. The Gatekeeper reward is a separate, narrower category; it is not another route to the $2 million maximum.
Why is Apple emphasizing complete exploit chains?
Apple is emphasizing complete exploit chains because advanced targeted attacks often combine multiple vulnerabilities to move from initial access to a more consequential security boundary. A chain might begin with a remote or browser-delivered entry point, escape a sandbox, cross privilege boundaries, and ultimately reach the kernel or sensitive data.
A crash or isolated memory-safety flaw can still be useful and potentially eligible for a reward, but it is not equivalent to a demonstrated zero-click chain that achieves kernel compromise. Apple says individual components and components that cannot be linked may remain eligible for proportionally smaller rewards.
Apple has described the most advanced attacks observed against iOS in the wild as highly sophisticated chains used against a small number of targeted individuals. That is Apple’s characterization of the threat environment, not a universal industry consensus that every system-level iOS threat has the same profile.
What are Target Flags?
Target Flags are Apple’s mechanism for objectively demonstrating that a researcher reached a specified security outcome, such as kernel-level privilege or another high-impact endpoint. Some reward categories require Target Flag confirmation before the stated reward can be considered.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Target Flags can also support accelerated awards. Apple says qualifying awards may be processed after the report is received and verified, even before Apple has released a fix. Target Flags are not available for every category or reward level, so researchers should check the applicable category rather than assume that every report receives fast-track treatment.
The Apple Security Bounty landing page describes Target Flags and the program’s current headline rewards, while the category and guideline pages provide the operational limitations.
What must a researcher submit?
A strong Apple bounty report must show what happened, why the behavior is a security problem, and how another analyst can reliably reproduce the result. Apple’s guidelines require a complete and actionable report submitted directly through Apple’s web portal.
Technical report checklist
- Describe the observed behavior and the expected behavior precisely.
- Identify the security or privacy mechanism that was bypassed.
- Explain the attacker’s starting conditions, including required access and user interaction.
- State the control, data, privilege, or security boundary obtained.
- Provide numbered reproduction steps.
- Attach a working exploit or reliable proof of concept.
- Include Target Flag evidence when the applicable reward category requires it.
- Use a nondestructive payload whenever appropriate.
- Provide source and compiled versions for exploit chains.
- Attach crash logs for crashing issues.
- Provide a sysdiagnose with the applicable profile for other issues.
- Include a video for certain user-interface authentication or Lock Screen bypass reports.
Apple advises submitting exploits and proof-of-concept files as attachments, preferably in a password-protected archive, rather than linking to a web-hosted exploit or video. Researchers should avoid accessing other people’s data and should keep testing nondestructive and within the program’s rules.
Who qualifies for an Apple Security Bounty?
An Apple bounty report generally needs to meet several conditions at the same time. The issue must have potential real-world security impact, be reproducible through a reliable proof of concept or working exploit, and affect the latest publicly available Apple software or hardware in a standard configuration, including relevant beta versions.
For service reports, the issue must concern an Apple-owned service or a subsidiary service. The report must be submitted directly to Apple, and the vulnerability must remain undisclosed until Apple releases an update with a security advisory.
| Requirement | What it means in practice | Common failure |
|---|---|---|
| Current target | Test the latest publicly available software and hardware in a standard configuration. | Reporting only an old operating-system version, unsupported device, or unusual setup. |
| Reproducibility | Supply a reliable proof of concept or working exploit. | Submitting a theoretical issue or an unverified crash description. |
| Complete and actionable report | Explain the starting point, steps, bypassed control, and final impact. | Providing a severity label without demonstrating the achieved endpoint. |
| First complete report | Apple rewards the first complete and actionable report it receives. | Assuming the earliest discovery date, rather than Apple’s receipt of a complete report, controls eligibility. |
| Responsible disclosure | Keep the issue private until Apple publishes a fix and security advisory. | Publishing exploit code or technical details prematurely. |
| Human validation | Validate the issue and evidence before submission. | Sending infeasible or AI-generated reports without proper testing. |
The first-report rule creates a practical trade-off. Researchers need to submit quickly, but an incomplete report may not establish eligibility as the first complete and actionable submission.
What can disqualify a report?
A technically interesting bug can still fail to qualify for the advertised maximum—or for any bounty—if it targets an old version, requires an unsupported configuration, lacks a reproducible proof of concept, was publicly disclosed too early, fails to reach the required endpoint, or duplicates an earlier complete report.
Free tools Windows power users keep installed
One-click scans. No signup required.
Apple says infeasible reports, including issues generated by artificial intelligence without proper human validation, are ineligible. Repeated ineligible submissions can lead to a 180-day pause, and researchers who have more than two paused periods may be removed from the program.
Public disclosure before Apple releases a fix and security advisory makes the report ineligible for all Apple Security Bounty rewards. Researchers should therefore avoid releasing technical details, exploit code, or enough information to enable public exploitation before Apple’s disclosure.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do researchers submit an Apple bounty report?
- Go to Apple Security Research.
- Sign in with an Apple Account.
- Submit the report through Apple’s web portal.
- Include the technical description, numbered reproduction steps, and proof of concept.
- Add Target Flag evidence when the selected category requires it.
- Track the report and answer Apple’s requests for additional information through the report page.
Apple sends an automatic acknowledgement for web submissions, and researchers can track report status through their Apple Account. Apple says most reports are resolved within 90 days, but that is a general expectation rather than a guaranteed deadline.
Apple generally makes reward decisions after resolving the issue. Reports using Target Flags that qualify for accelerated awards are an exception: Apple says those awards can be processed after verification before a fix is available.
How much has Apple actually paid?
Apple launched its public Security Bounty program in 2020. According to Apple’s October 10, 2025 announcement, Apple had awarded more than $35 million to more than 800 security researchers since the public program began, and multiple individual reports had earned $500,000.
The $35 million figure should be reported with that date. The official materials reviewed for this article do not provide a newer cumulative payout total, so “$35 million paid to date” should not be presented as a verified August 2026 lifetime total.
Apple did not disclose a median payout, average payout, acceptance rate, or complete category-by-category distribution in the cited announcement. Dividing $35 million by 800 would produce a crude lower-bound arithmetic figure of at least $43,750 per researcher, but that would not be a meaningful reported average: both source figures are rounded lower bounds, researchers may have submitted multiple reports, and rewards are likely unevenly distributed across categories and impact levels.
Can a typical bug bounty hunter realistically earn $2 million?
The $2 million ceiling is realistic as a published category maximum, but it is not a realistic expectation for an ordinary vulnerability report. The top category requires a current target, a practical network attack with no user interaction, a complete chain, kernel-level impact, reliable reproduction, and Target Flag confirmation where required.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsA single crash, theoretical vulnerability, user-space remote bug, browser code-execution issue, or incomplete chain may still be valuable, but Apple’s published table places those outcomes in lower categories. The program is therefore more lucrative at the extreme top while remaining highly selective and evidence-heavy.
Researchers should also account for the operational risk of racing to submit. The first complete and actionable report wins eligibility, but premature submission without reliable evidence can result in an incomplete or ineligible report. Public disclosure before Apple’s advisory can eliminate the bounty entirely.
Can a researcher request a reassessment?
A researcher may request reassessment within three weeks of a reward decision if important information already supplied was missed. Apple’s guidelines state that new information added after resolution generally does not trigger reassessment, except when additional research demonstrates a complete exploit chain.
This makes the initial report especially important: include the evidence, endpoint demonstration, logs, and chain details that support the requested category before Apple resolves the issue.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteApple Security Bounty timeline
| Date | Event |
|---|---|
| 2020 | Apple’s public Security Bounty program launched. |
| October 10, 2025 | Apple announced the redesign, the $2 million top reward, and more than $35 million paid to more than 800 researchers. |
| November 2025 | Apple said the updated payouts and categories would take effect. |
| August 18, 2026 | The $35 million amount remains the last specifically verified cumulative total in the reviewed materials, not a confirmed current total. |
Frequently Asked Questions
Is Apple’s $2 million bug bounty available for any security bug?
No. Apple’s $2 million maximum applies to a specified high-impact outcome: a network attack requiring no user interaction that reaches the kernel. Lower-impact outcomes, such as user-space execution, a sandbox escape, or browser code execution, have lower published maximums.
Is Apple’s $35 million payout figure current for August 2026?
Apple reported paying more than $35 million to more than 800 researchers on October 10, 2025. The reviewed official materials do not provide a newer cumulative total, so $35 million should not be described as a verified August 2026 total.
How can an Apple bounty exceed $5 million?
Apple says conditional bonuses can push a qualifying $2 million base award above $5 million. A 100% Lockdown Mode bonus and a 50% beta-software bonus are among the relevant pathways, but the bonuses have specific conditions and a payout above $5 million is extremely difficult and unlikely.
Does Apple pay for a theoretical or AI-generated vulnerability report?
Apple requires a complete, actionable, reproducible report with potential real-world impact and says infeasible reports, including AI-generated issues without proper human validation, are ineligible. Researchers must validate the vulnerability and provide reliable evidence.
Recommended Free Tools
The Bottom Line
Bottom line: Apple’s Security Bounty is substantially more valuable at the very top, but the $2 million reward targets a narrowly defined, spyware-grade exploit chain—not an ordinary Apple bug. Conditional bonuses can theoretically push a qualifying award above $5 million, while Apple’s reported $35 million cumulative payout must remain dated to October 10, 2025 until Apple publishes a newer total.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
