AI Vulnerability Flood Is Crashing Bug Bounty Payouts
The bug bounty economy is undergoing a structural shift as AI-assisted vulnerability research floods platforms with low-quality submissions, driving down payouts and squeezing independent security researchers. Platforms like HackerOne and Bugcrowd have historically paid researchers between $500 and $50,000 per validated flaw, but triage teams now report that AI-generated reports account for a growing share of submissions—many of which duplicate known issues, fabricate non-existent endpoints, or misinterpret scanner output as novel findings.
The underlying problem is straightforward: large language models can rapidly produce syntactically correct vulnerability reports that surface just enough plausible detail to pass initial automated triage. One Bugcrowd program manager noted in a recent disclosure that roughly 30% of incoming submissions now show hallmarks of AI generation—generic CWE references, hallucinated CVE numbers, and copy-paste remediation advice. This forces human reviewers to spend more time filtering noise than validating genuine security issues, and platforms have responded by tightening acceptance thresholds, reducing reward tiers, and in some cases suspending researchers whose report quality consistently fails manual review.
For independent researchers, the repricing is consequential. Median payouts on HackerOne fell to $450 in late 2025 according to the platform's own transparency reports, down from roughly $1,400 two years prior—a decline directly attributed to signal dilution from automated submissions. Full-time bug hunters who relied on steady income from web application flaws such as IDOR, SSRF, and broken access control now compete against LLM-driven volume that automated triage queues can't always distinguish from hand-crafted work. Researchers interviewed by Dark Reading warn that the economic model is eroding incentives for deep, time-intensive testing of complex targets like Active Directory environments and custom API logic.
The broader implication for defenders is mixed. More reported vulnerabilities mean more potential attack surface coverage, but only if reports are accurate. Organizations consuming bug bounty output should validate every submission against their own asset inventory and configuration baselines. Security teams can use a port scanner to confirm exposed services cited in reports, a DNS leak test to verify DNS-related claims, and a SSL/TLS checker to validate certificate and configuration findings before applying patches. As the AI-generated report deluge accelerates, distinguishing real bugs from machine-generated noise may itself become one of the most important skills in modern vulnerability management.