Bug bounty businesses bombarded with AI slop

Bug bounty platforms are being overwhelmed by a surge in AI-generated low-quality vulnerability reports, forcing companies to introduce stricter vetting procedures and filtering tools to manage submissions. Projects like Curl and Nextcloud have suspended their bug bounty programs due to the explosion of AI-generated slop that consumes significant time and effort to disprove. Valid submissions have dropped from roughly 15% to below 5% as AI-generated content floods the gates.

Source: Ars Technica | 2026-05-18