Apple Revamps Bug Bounty Program, Now Offers Up to $2 Million Rewards

As always, Apple is taking its security game up a notch. The Cupertino tech giant has announced that it is doubling its bug bounty program reward, a massive $2 million for exploit chains that match the sophistication of mercenary spyware attacks.

There’s more to this: The company will reward bonuses for Lockdown Mode bypasses and vulnerabilities found in beta software, pushing potential total payouts to over $5 million. Apple says this is the largest bounty offered by any security program.

Focus Shifts to Exploit Chains

While Apple previously rewarded isolated bugs, the company will now place more emphasis on complete exploit chains. This is because most real-world cyber attackers typically combine multiple vulnerabilities to gain deeper access.

Besides this change, rewards for remote-entry vectors have been substantially increased. On the other hand, categories that are less likely to be exploited in real attacks will see lower payouts.

Target Flags Bring Faster Payouts

Have you ever played CS:GO’s “Capture the flag” mode? Apple is taking inspiration from it and is introducing Target Flags. Now, whenever a researcher successfully exploits a vulnerability, they can capture a specific flag that indicates the level of access achieved, such as code execution or arbitrary read/write access to system memory.

Once Apple verifies the flag, the bounty amount is immediately confirmed, and the payment is released in the next payout cycle, departing from the previous model where researchers often had to wait months for a fix before receiving payment.

Expanded Categories and Bigger Rewards

The overhauled program, launching in November 2025, adds new categories and increases payouts:

• One-click WebKit sandbox escapes: Up to $300,000
• Wireless proximity exploits (any radio): Up to $1 million
• Complete Gatekeeper bypass on macOS: $100,000

Apple’s Bug Bounty Payouts So Far

Since launching the public bounty program in 2020, Apple has paid over $35 million to more than 800 researchers. You can check updated program details on the Apple Security Research website.

What do you think about Apple’s new $2 million top reward? Let us know in the comments.