What did Apple credit Red Team Partners for?

Apple lists Hein Htet Aung (@redteampartnersglobal) on its Web Server Security Acknowledgements page for August 2026. Apple states that the page credits people who reported potential security issues in its web servers, and that credit is added after an issue has been identified and addressed. The report concerned how generated content was handled and rendered by the application presenting it. The report was submitted on 29 July 2026, accepted on 11 August, and remediation was recorded as deployed on 17 September. No exploit detail or payloads are published, which is the point of coordinated disclosure: the fix ships before the method does.

Why does an AI security test need to cover more than the model?

Because a model can behave exactly as intended while the application around it does not. A typical chain runs user input, model, generated response, application, rendering engine, browser. Every step is a trust boundary, and generated content crossing one of them is content the application did not author and usually does not treat with suspicion. Testing prompt handling alone leaves the second half of that chain unexamined. The useful question is not only what the model can be persuaded to say, but what the application does with the answer once it has it.

Does Red Team Partners publish exploit details?

No. Findings go to the vendor first, and detail is withheld until a fix is deployed. This report went to Apple through its security reporting programme and the write-up carries no payloads. The same applies to open-source work: an osTicket vulnerability reported by the same researcher was fixed in the project before anything was written about it.

Research / Responsible disclosure

Apple Credits the Researcher Who Runs Our AI Penetration Testing.

Hein Htet Aung reported unexpected Markdown-rendering behaviour found while testing how AI-generated output is processed and presented by the application around it. Apple verified it, fixed it, and credited him on its Web Server Security Acknowledgements for August 2026.

Author: Hein Htet Aung
Read: 7 MIN READ
Filed: 29 September 2026

01 What happened

Apple lists Hein Htet Aung, one of our security researchers, on its Web Server Security Acknowledgements for August 2026. Apple's own wording is that the page credits people who reported potential security issues in its web servers, and that a name is added once an issue has been identified and addressed Apple Security Acknowledgements .

02 The gap the finding sat in

Most AI security work stops at the model. It asks what the model can be persuaded to say, which is a real question and an incomplete one. A generated response does not end at the model. It travels: into the application, through a rendering engine, into a browser. Each of those hand-offs is a trust boundary, and generated content is the one kind of content an application did not write and rarely treats with suspicion.

Put plainly, the chain is user input, model, generated response, application, rendering engine, browser. A programme that tests only the first two links has examined half of it. The finding Apple fixed lived at that boundary. That is why it is worth writing about even without the detail.

03 How the disclosure ran

The report went to Apple through its security reporting programme and nowhere else. No detail was published while a fix was outstanding, and none is published here: this article contains no payloads and no reproduction steps. That is not caution for its own sake. A finding released before a fix is a finding weaponised against the users of the product.

The same rule applies to open-source work. A separate vulnerability reported by the same researcher was fixed in osTicket, where the maintainers credited the report in the commit that shipped the sanitisation osTicket PR #5616 . In both cases the vendor fixed it first and the public record followed.

04 What AI penetration testing has to cover

If you have shipped an AI feature, the useful scope is wider than the model and narrower than "everything". These are the areas where the two disciplines meet, and where a finding like this one is found:

Scope for an AI feature already in production

How generated output is handled before it is displayed, and whether it is escaped the way user input would be.
What the rendering layer does with formatting it did not expect.
Which tools and integrations the model can reach, and with whose permissions.
Where generated content crosses an API boundary into another system.
The ordinary application vulnerabilities surrounding the feature, which do not stop mattering because there is a model in the middle.

None of that is exotic. It is penetration testing applied to a component that behaves differently from the ones the discipline grew up on. It is where the work is, once everyone has finished testing prompts.

What of yours is already exposed?

We search the breach corpus and the criminal markets for your domain, your staff addresses and the credentials attached to them. You get the list back, whether or not we ever speak.

The model is the easy half.
We test the other half.

Prompt handling, output handling, rendering, tool access and the ordinary web vulnerabilities around an AI feature. Every finding proven, nothing published before it is fixed.

Book a scoping call AI security testing Not a partner? Get a free audit →

References

Sources

Apple. Web Server Security Acknowledgements — August 2026. Credits "Hein Htet Aung (@redteampartnersglobal)". support.apple.com
osTicket. Pull request #5616 — security fixes crediting reporter heinhtetaung, including sanitisation of Internal Note contents. github.com
OWASP. Top 10 for Large Language Model Applications. owasp.org