Companies struggle with low-quality AI submissions in bug bounty schemes.
Companies relying on bug bounty programs are facing an influx of low-quality reports generated by artificial intelligence. Platforms like Bugcrowd, which handles bounties for major tech firms including OpenAI and T-Mobile, have seen a significant increase in false submissions. Security experts predict changes to the existing systems as they adapt to this new reality.
The rise of generative AI tools has both accelerated vulnerability discovery and lowered barriers for entry, leading to an overwhelming number of reports that require manual vetting. This not only increases operational costs but also hampers effective resource allocation for experienced researchers. Companies like Curl have suspended their programs due to the ‘explosion in AI slop reports,’ highlighting the urgent need for better filtering mechanisms.
For builders and operators, this development necessitates a more robust approach to triaging bug submissions. Implementing stringent background checks and developing specialized AI tools for automated sorting can help address the surge in poor-quality reports. Enterprises must stay vigilant as AI continues to evolve, impacting their cybersecurity strategies and operational efficiency.
As Anthropic launches its new Mythos model aimed at faster flaw detection, companies are increasingly turning to AI solutions to manage submissions effectively. The next step involves finding a balance between leveraging AI for triage while maintaining human oversight to ensure the quality of findings.
What matters
- Security firms receive quadrupled bug reports from AI, many false.
- Builders must cope with automated or erroneous submissions overwhelming systems.
- Firms plan to introduce stricter checks and AI agents for triaging.
Why it matters
Firms plan to introduce stricter checks and AI agents for triaging.
This GenAI News article was prepared in original wording using reporting and materials published by Ars Technica. Source reference: https://arstechnica.com/ai/2026/05/bug-bounty-businesses-bombarded-with-ai-slop/.
Drafted by the GenAI News review pipeline.