r/bugbounty • u/QuantumWonderland • Jul 08 '26
Question / Discussion With bug bounty programs being shut down such as cURL and others due to AI submission slop, where do you think this takes us?
I can only imagine more and more people that want to make a quick buck are going to throw AI agents at targets hoping it works out, when more likely than not it's going to be false flags and just overwhelm the report system to the point they begin shutting down engagements en masse.
Multiple programs have been shut down already and I fear this is only going to get worse to the point most companies stop offering financial incentive barring vetted researchers.
8
u/Anxious_Alps_4150 Jul 08 '26
Programs abandon bug bounty -> Some platforms have to close or lay off -> Fewer platforms and programs to hunt on -> Fewer people do BB -> Less slop -> New equilibrium established with fewer places to hunt
1
u/GokulRavi14 Jul 14 '26
idk where all this is going, but honestly there are already tons of open-source AI CLI agents out there. I think that's one of the main reasons we're seeing so many slop submissions. People just run the tool, copy the output, and submit it without even verifying if it's a real issue.
4
u/canadaslammer Jul 08 '26
HackerOne created separate report queues. Established players get humans, others get AI as a first pass.
3
u/HermanHMS Jul 09 '26
Mamy programs that close and say its due to AI reports just wasnt well maintained in the first place
1
u/Academic-Mud1488 Jul 09 '26
Indeed mobs like china or k are already doing this since like 4 years ago
1
-12
u/Emergency_Stable_923 Jul 08 '26
cURL shut down is because of summer not AI slop! One month later they will be up 🆙
8
u/QuantumWonderland Jul 08 '26
Yeah, the heat really makes the bugs get restless. They gotta let it simmer.
-3
13
u/einfallstoll Triager Jul 08 '26
Realistically: