Summary: AI-generated bug reports are overwhelming security programs, leading to a decline in quality and prompting some companies to suspend their initiatives. Experts warn that bug bounties must adapt to stay relevant.

Bug bounty programs, once a trusted way for companies to find software vulnerabilities, are now facing a new challenge: AI-generated noise. As generative AI tools become more accessible, they’re flooding security platforms with low-quality or false reports, forcing some companies to pause their programs altogether.

For years, bug bounties have relied on skilled independent researchers to identify critical flaws in software. However, the rise of AI-powered tools is disrupting this model. Companies like Bugcrowd, which serves clients such as OpenAI and T-Mobile, reported a fourfold increase in submissions over just three weeks in March—most of which were false positives.

Curl, a widely used data-transfer tool, recently suspended its bug bounty program due to an overwhelming influx of AI-generated reports. Cybersecurity experts note that while AI can speed up the work of experienced researchers, it’s also lowering the barrier to entry, resulting in a surge of automated or inaccurate submissions.

Ross McKerchar, CISO at Sophos, warns that the quality of reports is deteriorating rapidly. He believes bug bounties will continue to exist but must evolve to handle the new reality. The rise of AI is not just changing how bugs are found—it’s reshaping the economics and effectiveness of these programs.

Despite the challenges, bug bounties remain a key part of cybersecurity strategy. Google alone paid out $17 million in rewards last year, including a $605,000 payout for a major Android vulnerability. But with AI-generated noise on the rise, companies are rethinking how they manage these programs and what kind of expertise they need to filter out the noise.

Tags: #AI #Cybersecurity #BugBounty #TechTrends

Source: https://arstechnica.com/ai/2026/05/bug-bounty-businesses-bombarded-with-ai-slop/