AI Slop Floods Bug Bounty Programs as Companies Struggle with Fake Reports

TL;DR

Companies are facing a rise in low-quality AI-generated submissions in bug bounty programs, leading some to suspend their initiatives. Security teams are overwhelmed by sorting real vulnerabilities from fake reports.

Key points

Increase in low-quality AI-generated bug submissions
HackerOne and Nextcloud suspended their programs
Security teams overwhelmed by fake reports
Bug bounty programs are a significant financial investment
Companies paid at least $58 million in 2025

Mentioned in this story

HackerOneNextcloudMetaMicrosoftAppleCrypto.com

In brief

Companies running bug bounty programs report a sharp increase in low-quality AI-generated submissions.
HackerOne and Nextcloud both suspended bug bounty programs after waves of fake reports.
Security firms say AI tools are changing bug hunting by making it easier to submit reports at scale.

Artificial intelligence is creating a new headache for companies that rely on bug bounty programs to uncover software vulnerabilities.

Cybersecurity firms and open-source software projects are dealing with a surge of AI-generated bug reports, many of which are false or misleading. That's per a report from Financial Times, which says that the growing number of low-quality submissions is forcing some organizations to pause bug bounty programs as security teams spend more time sorting real vulnerabilities from spam.

Bug bounties have also become big business, with companies including Meta, Microsoft, Apple, and Crypto.com collectively paying at least $58 million in 2025 to researchers who find software flaws before hackers do.

However, generative AI tools are also making it easier to exploit bug bounty programs by producing large volumes of inaccurate or low-quality vulnerability reports at scale.

According to San Francisco-based Bugcrowd, reports submitted through its platform more than quadrupled during three weeks in March. The company, whose clients include ChatGPT developer OpenAI, said most of the reports were fake.

Because of the flood of AI-generated reports, some companies have already begun rolling back their public bounty programs.

“Bug bounties are going to stay [but] they’re going to have to change,” Ross McKerchar, chief information security officer at cybersecurity company Sophos, told the Financial Times.

In April, cybersecurity platform HackerOne and hosting platform Nextcloud both suspended their paid bounty program, with Nextcloud adding that “no financial rewards will be awarded for any submissions, regardless of severity.”

Q&A

What impact is AI having on bug bounty programs?

AI is causing an increase in low-quality, fake bug reports, which is overwhelming security teams and leading some companies to suspend their programs.

Which companies have suspended their bug bounty programs due to AI-generated reports?

HackerOne and Nextcloud have both suspended their bug bounty programs in response to the surge of fake reports.

How much money are companies paying for bug bounty programs in 2025?

In 2025, companies like Meta, Microsoft, Apple, and Crypto.com collectively paid at least $58 million to researchers for finding software vulnerabilities.