Apple Bug Bounty Update: Top Payout Now $2 Million, $35 Million Paid to Date

According to SecurityWeek, Apple has updated its bug bounty programme, raising the top payout for a zero-click exploit chain that achieves remote device compromise from $1 million to $2 million, with the potential to reach $5 million including bonuses for Lockdown Mode bypasses and beta software vulnerabilities.

Since launching its public bug bounty programme in 2020, Apple says it has awarded more than $35 million to over 800 security researchers, and notes that several researchers have earned $500,000 for their work. The company also increased rewards across other categories, including sandbox escapes, physical-access attacks, wireless attacks, and one-click browser-based exploits, with some caps rising to $1 million or more.

The changes, including the introduction of Target Flags to help researchers demonstrate findings and qualify for rewards, will take effect in November 2025. Apple also highlighted further new payout possibilities, such as a macOS Gatekeeper bypass ($100,000) and unauthorized iCloud access ($1 million), as part of its broader push to engage external offensive security talent, according to SecurityWeek.