Expanded rewards and new categories
Apple has announced a broad expansion of its security bounty program, with top rewards rising for a range of attack vectors and vulnerabilities. The changes, set to take effect in November 2025, reflect Apple’s ongoing effort to outpace evolving threats from mercenary spyware makers and other sophisticated adversaries. The company emphasizes that researchers will now see higher payouts for a variety of exploits, including zero-click chains, iCloud access, and WebKit-related code execution paths.
What counts for the top payouts
Under the updated plan, the most lucrative rewards apply to issues that affect Apple’s latest publicly available software and hardware, the versions Apple regards as having the strongest protections. However, Apple also notes that individual components of a chain may qualify for separate, smaller rewards. The program will continue to reward not only full exploit chains but also meaningful steps along the way, which can help researchers monetize intermediate findings while working toward a complete vulnerability chain.
Examples of high-value exploits
Several notable maximum rewards have been outlined, signaling where researchers might focus efforts. For full Gatekeeper bypass with no user interaction, the maximum is $100,000. Chaining WebKit’s WebContent code execution with a sandbox escape can yield up to $300,000. A longer chain—WebKit WebContent code execution plus sandbox escape plus unsigned code execution with arbitrary entitlements—can reach $1 million. Broad unauthorized iCloud access and wireless proximity exploits across all radio interfaces in the latest devices are both capped at $1 million.
New tools and clarity for researchers
Apple is introducing Target Flags, a new method that allows researchers to clearly indicate when certain security issues can be exploited in practical ways. This addition is designed to streamline submission quality, helping researchers convey the exploit’s potential impact and reproducibility. The combination of Target Flags and expanded categories is intended to make it easier for researchers to describe complex multi-step attacks and for Apple to verify them more efficiently.
Beta software and Lockdown Mode considerations
In addition to the standard vulnerability rewards, Apple’s bonus system provides extra incentives for bypassing Lockdown Mode limits and for vulnerabilities discovered in beta software. These bonuses can more than double the base payout, with the potential to exceed $5 million in certain circumstances. This emphasis on the most forward-looking protections underscores Apple’s commitment to defending against the most advanced threats, even as attackers continually evolve techniques.
Accessibility for newer researchers
Recognizing that some researchers are just beginning their security testing, Apple announced smaller rewards for low-impact findings outside established categories. Beginning researchers can earn $1,000 for qualifying discoveries, which helps broaden participation and edge new talent toward more impactful, high-reward targets in the future.
What this means for researchers and defenders
The revamped bounty program is a signal that Apple intends to keep pace with a rapidly changing threat landscape. By offering higher payouts for sophisticated, multi-vector exploits and improving the program’s tooling, Apple hopes to attract a broader pool of researchers who can help surface dangerous flaws before they can be weaponized. For defenders, the updates also guide security teams on the latest areas where attackers are focusing their attention, such as memory integrity enforcement, browser sandbox protections, and the broader Safari security architecture improvement efforts.
Implementation timeline and next steps
Apple will publish the complete list of new and expanded categories, rewards, and bonuses on the Apple Security Research site in November 2025. The company will also provide detailed instructions for using Target Flags and updated program guidelines. Researchers are encouraged to review the forthcoming materials to understand the new payout structure, submission requirements, and the criteria used to determine the final reward amounts.
