Bug bounty businesses bombarded with AI slop

2026-05-18 · Source: AI - Ars Technica · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Software Development & Engineering · Depth: Intermediate, short

Summary

Companies operating bug bounty programs, which compensate independent security researchers for identifying software vulnerabilities, are experiencing a significant increase in low-quality, AI-generated reports. This surge has led some organizations, including Curl and Nextcloud, to suspend their programs due to the overwhelming volume of spurious submissions. Bugcrowd, serving clients like OpenAI and T-Mobile, reported a quadrupling of reports in March, with most proving false. While generative AI tools enable experienced researchers to work more efficiently, they also lower the barrier to entry, resulting in a flood of automated or erroneous submissions. Cybersecurity experts, such as Ross McKerchar of Sophos, acknowledge this as a major problem, predicting that bug bounties will need to adapt. Despite the challenges, platforms like HackerOne are implementing AI-driven validation capabilities to manage high volumes, and some industry leaders believe AI will augment, rather than replace, human creativity in bug hunting.

Key takeaway

For CTOs and VPs of Engineering managing security programs, the rise of AI-generated "slop reports" necessitates a re-evaluation of your bug bounty strategy. You should explore integrating AI-powered triage and validation systems, similar to those adopted by HackerOne, to filter low-quality submissions efficiently. Consider more stringent researcher vetting or temporary program adjustments to maintain program integrity and prevent researcher burnout, ensuring your security investments yield legitimate vulnerability discoveries.

Key insights

AI tools are overwhelming bug bounty programs with low-quality reports, necessitating program adaptation and AI-driven triage.

Principles

• AI lowers entry barriers for vulnerability discovery.
• Human creativity remains essential in complex bug hunting.

Method

Companies are implementing more stringent background checks and developing AI agents for triaging submissions to manage the influx of low-quality reports.

In practice

• Use AI for initial vulnerability scanning.
• Implement AI-driven validation for report triage.

Topics

• Bug Bounty Programs
• AI-Generated Reports
• Cybersecurity Vulnerabilities
• HackerOne
• Anthropic Mythos

Best for: CTO, VP of Engineering/Data, AI Security Engineer, Security Engineer, Director of AI/ML

Related on AIssential

• Raising the bar: Quality, shared responsibility, and the future of GitHub’s bug bounty program — Bug bounty programs are adapting to AI-driven volume by prioritizing validated, high-impact submissions and clarifying shared security responsibilities.
• Discord Sleuths Gained Unauthorized Access to Anthropic’s Mythos — AI models are proving effective in both enhancing cybersecurity defenses and enabling sophisticated cyberattacks.
• OpenAI’s Daybreak and Mistral’s Mythos competitor — AI vulnerability tools are force multipliers requiring human validation and defense-in-depth strategies against evolving threats.
• Google Bug Hunter Claims $500K From AI-Assisted Vulnerability Pipeline — AI-assisted tools can significantly amplify vulnerability discovery, particularly for widespread API exposure.
• Introducing the OpenAI Safety Bug Bounty program — OpenAI's new bug bounty targets AI-specific abuse and safety risks beyond traditional security vulnerabilities.
• Vulnerability Research Is Cooked — Frontier AI models will drastically accelerate vulnerability research by automating zero-day exploit discovery.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by AI - Ars Technica.