AI Floods Bug Bounties, Rewriting Security Economics

A decade ago, bug bounty programs marked a significant shift towards acknowledging the necessity of external security research. Initially offering rewards up to $200,000, these programs saw payouts escalate, with top rewards reaching $2 million by last year. However, the landscape is rapidly evolving due to advancements in agentic AI.

As AI models become more proficient in autonomously identifying software vulnerabilities and creating exploits, vulnerability disclosure programs are experiencing a flood of submissions. This surge means organizations are discovering more bugs than ever before. The economics of bug bounties are being reshaped for both institutions and researchers, impacting those who rely on this work for income.

Security researcher Joseph Thacker notes a threefold increase in bug submissions compared to the previous year, predicting significant spending increases by companies like Google. While tech giants can absorb this pressure, smaller companies may struggle. Thacker anticipates fewer submissions next year as initial AI-driven discoveries diminish, potentially leading some companies to further increase payouts.

Experts acknowledge uncertainty regarding long-term supply and demand dynamics. The effectiveness of AI in exploit discovery and automated scanning could compel developers to expedite patch releases, potentially shortening established 90-day disclosure deadlines. This acceleration is a direct response to AI's ability to compress the timelines for both finding bugs and developing exploits.

Furthermore, attackers are increasingly leveraging AI to enhance their capabilities and reduce costs. Google researchers have observed cybercrime actors using AI tools to exploit zero-day vulnerabilities, as seen in an attempt to bypass two-factor authentication on an open-source system. This incident serves as a critical illustration of the evolving bug-hunting landscape, where AI-powered attacks are becoming a tangible reality.