Topic starter
18/08/2026 2:51 pm
TL;DR: AI is changing bug bounty work by helping researchers uncover new classes of flaws, but it is also raising the cost of participation through token consumption and competitive pressure, according to INTIGRITI’s discussion with Leo Racanelli. The bigger issue is that AI-assisted testing is becoming part of the security operating model, which forces teams to rethink how they scope, validate, and budget for discovery.
Editorial analysis by NHI Mgmt Group, based on content published by INTIGRITI: “Securing the uncharted territories of AI systems. A discussion with Leo Racanelli”.
Key questions
Q: What breaks when AI bug bounty workflows depend on token budgets?
A: When AI-assisted hunting depends on token budgets, discovery becomes less equal and more commercially gated.
Q: Why does AI assistance improve vulnerability discovery in bug bounty workflows?
A: AI improves discovery because it reduces the time spent on repetitive search work.
Q: What do practitioners get wrong about autonomous AI in bug bounty?
A: They assume automation can replace judgement.
Practitioner guidance
- Define AI scope rules for bug bounty programmes Spell out which AI features, chatbots, prompt flows, and model-linked behaviours are in scope, and distinguish them from ordinary web application testing boundaries.
- Budget for researcher AI usage pressure Account for token consumption, repeated model calls, and higher validation overhead when planning live events, payout structures, and programme participation expectations.
- Expand triage for AI-generated findings Train reviewers to recognise model-assisted reports, normalise unfamiliar bug classes, and separate novel findings from repeated dead ends without rejecting them by default.
Bottom line: AI-assisted bug bounty expands the set of bugs researchers can find, but it also changes the economics of who can compete effectively.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:33 pm
AI-assisted discovery is becoming a programme design issue, not just a researcher productivity issue. Once AI is part of the hunting workflow, organisations are no longer managing only vulnerability intake. They are also managing how discovery capacity, review quality, and triage economics change when participants use paid models to find flaws faster. The practical conclusion is that bounty governance now has to account for tooling asymmetry, not just report volume.
A question worth separating out:
Q: How should organisations govern AI-assisted security research?
A: Organisations should govern AI-assisted research as part of programme design, not as an add-on tool choice. That means defining scope, triage expectations, acceptable usage costs, and how AI-generated leads are validated. It also means deciding how much of the workflow can rely on AI before human oversight becomes too thin.
👉 Read our full editorial: AI bug bounty workflows expose a widening security and cost gap