Getty Images/iStockphoto
Bug bounty reckoning: AI slop forces enterprise strategy shift
As AI fills bug bounty queues with low-quality report slop, tech giants like Intel and Google are rethinking paid rewards and shifting toward automated internal defenses.
As generative AI tools flood vulnerability intake pipelines with plausible-looking "slop," tech giants are reconsidering the ROI of traditional, paid bug bounty programs. Between external triage exhaustion and the rise of internal automated AI auditing, industry heavyweights like Intel and Google are forcing a rewrite of vulnerability disclosure rules.
What began as isolated adjustments could herald an industry-wide pivot. Earlier this year, Curl creator Daniel Stenberg shut down the project's bug bounty program after being overwhelmed by a flood of LLM-generated false positives.
By mid-September, reports surfaced that Intel had quietly suspended cash rewards for its long-running bug bounty program. Weeks later, on October 1, Google stopped accepting vulnerability reports for its own Open-Source Software Vulnerability Reward Program (OSS VRP), explicitly citing an unsustainable influx of invalid, automated reports.
Together, these moves mark a turning point in vulnerability management. Security teams are facing an asymmetric resource drain in which low-effort AI reports cost submitters almost nothing to generate but require hundreds of expensive engineering hours to manually review and debunk.
Triage under pressure
Intel's sudden pause on paid bug bounties is one of the most prominent casualties of this shifting operational landscape.
In a statement to TechTarget, the tech giant said: "As part of an ongoing review of how the bug bounty program can best support Intel's broader product security efforts, Intel has paused the program until further notice. Intel will continue to honor existing bug bounty commitments and accept security reports through its Vulnerability Disclosure Program."
Intel did not respond to a follow-up question about whether the decision had been prompted by an increase in the use of AI tools to discover vulnerabilities. However, Kara Sprague, CEO of HackerOne -- the platform hosting Intel's rewards program -- confirmed that submission volumes across enterprise programs are surging.
"More of them look credible at first glance but were never tested against the target or are outside the program's scope: a report can now be written in minutes," she said.
"Validating it still takes what it always did: reproducing the finding, confirming the impact and deciding whether it needs a fix. That is the constraint on every program right now, and it is the work we have built our platform around."
Industry data underscores the sheer scale of this vulnerability disclosure bottleneck. According to a recent report from Google, the number of vulnerabilities disclosed per month doubled between January and July 2026, rising from 5,045 in January to 10,477 in July, before climbing further to 10,740 in August.
The shift to internal auditing
As the maintainers of Curl discovered, a substantial increase in submissions takes critical time away from the analysts and researchers who must review each report. As a result, the emphasis is shifting towards ensuring that submissions meet specific criteria and reducing the time spent assessing reports that do not identify genuine vulnerabilities.
Reflecting on the collapse of Curl's bug bounty program in a post on his blog, creator Daniel Stenberg tracked the clear correlation between the widespread adoption of generative AI tools like ChatGPT and the plummeting signal-to-noise ratio in disclosure queues.
"Looking back, I think we can say that the downfall of the bug bounty program started slowly in the second half of 2024 but accelerated badly in 2025," Stenberg wrote.
In Intel's case, the company confirmed that its program had been paused rather than scrapped altogether. Katie Moussouris, CEO of Luta Security, said she suspected that two complementary factors led Intel to stop paying for bugs: a flood of low-quality AI-generated reports and Intel's own teams deploying AI to find vulnerabilities more efficiently in-house.
These high-profile pauses raise fundamental questions about the long-term viability of crowdsourced security. Rather than an outright extinction of bug bounties, however, experts view the current disruption as a permanent realignment of enterprise security budgets.
Moussouris told TechTarget she did not believe bug bounties would return to their former pricing levels. While vulnerability disclosure remains welcome, she noted that the wider picture depends on how quickly AI can automate internal testing and patch creation.
"The investment in software that is secure by design and using AI internally to find and fix vulnerabilities will take up more budget and time than what has been previously allocated to external testing of all kinds," she said. "AI tooling, agentic red teaming and bug bounties become too burdensome for most organizations to find value among the duplicates and false reports."
An industry at a crossroads
Sprague said she expects more programs to change their rules, and some may pause rewards. "The problem many program owners face is familiar: more reports are coming in, and someone has to work out which ones warrant attention from engineering," she said.
"There's another side to this, though: we're also seeing more valid findings than ever. Pausing a program may ease the volume, but it means losing the work of researchers who are finding real issues."
The HackerOne CEO stressed that pausing rewards is a difficult choice because a program may still receive the same raw volume of unvetted reports while losing access to the skilled researchers capable of uncovering complex flaws.
"If the problem is sorting through the volume, we need to get better at that work," Sprague said. "Those researchers are still worth listening to."
The impact of Intel's pause will be felt across the industry: from researchers seeking payment for their work to the organizations that receive reports, validate vulnerabilities and develop patches.
With major technology companies now scaling back aspects of their bug bounty programs, the question is whether others will follow suit -- and whether the sector can adapt to a world in which AI makes finding potential vulnerabilities easier, but validating them remains a significant challenge.
Dan Raywood is a journalist with more than 20 years of professional writing experience, including more than 12 years covering cybersecurity.
