The Apple bug bounty program just got its biggest update yet, with the tech giant now offering up to $2 million for complex exploit chains. The move underscores Apple’s growing commitment to working with security researchers to strengthen the defenses of its devices.
Since launching the public bug bounty in 2020, Apple has paid more than $35 million to over 800 researchers. Several ethical hackers earned $500,000 each for major discoveries — proof that the company takes external security contributions seriously.
Recently, Apple introduced Memory Integrity Enforcement (MIE), an always-on protection that safeguards iPhones from advanced threats like mercenary spyware. The company believes these attacks pose the biggest risk to users and is now expanding its bug bounty program to attract even more top-tier talent from the global security community.
As part of this update, Apple has doubled the top reward for a zero-click exploit chain that achieves full remote device compromise, now set at $2 million. That figure could rise to $5 million if researchers find additional vulnerabilities that bypass Lockdown Mode or are discovered in beta software versions.
While earning the top payout is rare, Apple says these incentives push researchers to uncover the most sophisticated vulnerabilities before bad actors can exploit them.
Other categories are also seeing big increases. Escaping an application sandbox now pays up to $500,000, while physical and wireless attacks that once earned $250,000 can now fetch between $500,000 and $1 million. Remote one-click exploits, which typically involve some user interaction, will also pay as much as $1 million.
Apple is rewarding persistence even in less-explored areas. A macOS Gatekeeper bypass could now earn $100,000, while finding a way to gain unauthorized iCloud access could bring in $1 million. The new payouts will officially roll out in November 2025.
To make the process more transparent, Apple is introducing a new concept called Target Flags, inspired by capture-the-flag competitions. These flags will help researchers demonstrate exactly what level of control or access they achieved — from register control to full code execution.
Each Target Flag will correspond directly to a specific payout range, allowing researchers to know upfront what their work is worth. Once Apple verifies a submitted flag, researchers will receive an immediate notification of their reward.
Target Flags will be available across iOS, iPadOS, macOS, visionOS, watchOS, and tvOS. Apple also confirmed that exceptional research can still earn extra bonuses and that even low-impact vulnerabilities will receive at least $1,000, encouraging continuous discovery.
With these upgrades, the Apple bug bounty program has become one of the most rewarding and transparent initiatives in the cybersecurity industry — reinforcing Apple’s message that collaboration drives stronger security.
