Bug bounty businesses bombarded with AI slop

Bug bounty programs, which reward hackers for identifying software vulnerabilities, are facing significant challenges due to a surge in low-quality submissions generated by artificial intelligence. This influx of unreliable reports is prompting some companies to rethink their bug bounty strategies altogether. Bugcrowd, a notable platform in this field that serves clients including OpenAI, T-Mobile, and Motorola, reported that the volume of submissions it received skyrocketed over four times in just three weeks this past March. Unfortunately, the majority of these reports turned out to be invalid. In response to this growing issue, Curl, a popular tool for internet data transfer, halted its paid bug bounty program earlier this year, citing what it termed an “explosion in AI-generated slop reports” and a decline in submission quality. Experts in cybersecurity are observing that advancements in generative AI are transforming the landscape of bug bounty programs. While these tools enable seasoned researchers to identify vulnerabilities more efficiently, they also lower the entry barrier for newcomers, resulting in a deluge of automated or incorrect reports that companies must manage. Ross McKerchar, the chief information security officer at Sophos, emphasized that the increase in subpar AI-generated reports is rapidly becoming a pressing issue. He remarked, “Bug bounties are going to stay [but] they’re going to have to change.” Since their inception in the early 2000s, bug bounty programs have gained traction, with some offering substantial six-figure rewards for significant discoveries. For instance, Google’s initiative distributed $17 million last year, a sharp rise from $7.5 million in 2021, including a record individual payout of $605,000 in 2022 for a vulnerability found in its Android mobile operating system. McKerchar pointed out that the rise in poor-quality submissions stems from both novices attempting to find bugs and seasoned researchers who may be misled by AI agents during their investigations.