AI Flood Overwhelms Bug Bounty Programs

Businesses with bug bounty programs are facing an overwhelming number of low-quality reports, largely generated by artificial intelligence. This issue has become so severe that some companies have had to suspend their initiatives. Bugcrowd, a platform serving clients like OpenAI and T-Mobile, reported a quadrupling of submissions in March, with most being invalid.

Curl, a widely used data transfer tool, halted its paid bug bounty program in January due to an "explosion in AI slop reports." Experts observe that while AI tools can enhance the speed of experienced researchers, they also enable a flood of automated or erroneous submissions. This poses a significant challenge, prompting cybersecurity groups like Sophos to acknowledge the need for changes in bug bounty structures.

Software group Nextcloud also suspended its program in April, citing a "massive increase of low-quality reports," and aims to resume once effective filtering is established. In response, platforms like HackerOne are implementing "agentic validation capabilities" to assist organizations in managing high volumes of findings, including those from new AI models such as Anthropic's Mythos. Despite the challenges, some acknowledge AI's potential to assist human bug bounty hunters, emphasizing that human creativity remains indispensable.