Bug bounty businesses bombarded with AI slop

AI might cut false positives, but it won’t stop the slop

GitHub and industry leaders warn of a massive surge in unvalidated AI vulnerability reporting, forcing bug bounty programs to tighten rules against the noise.

GitHub will start paying some bug bounty hunters in swag instead of cash

Bug bounties have served as one of cybersecurity’s core pressure valves for decades, giving independent researchers a structured way to disclose vulnerabilities before attackers can exploit them. But a deluge of AI-assisted reports is upending parts of that system. GitHub announced last week that it’s tightening standards across its bug bounty program as submission volumes rise sharply alongside the growing use of AI tools in security research. …

Bug bounty businesses bombarded with AI slop

Companies that pay hackers to find flaws in their software are being inundated with low-quality reports generated by AI, forcing some to suspend the programs altogether. Businesses that run “bug bounty” schemes have long relied on independent security researchers to spot vulnerabilities. But the rise of AI tools is now overwhelming them with spurious submissions. Bugcrowd, whose customers include OpenAI, T-Mobile, and Motorola, said the number o…

AI Slop Floods Bug Bounty Programs as Companies Struggle with Fake Reports

Bug bounty platforms and software companies are struggling to handle a surge of low-quality, AI-generated vulnerability reports.