Notifications
Clear all
Topic starter
02/08/2026 11:46 am
TL;DR: AI-assisted bug finding is driving a surge in report volume, but validation and remediation costs have not fallen, creating a load problem for maintainers and security teams, according to Aikido’s analysis. The model is shifting from broad incentive-driven disclosure toward more targeted, higher-signal vulnerability reporting that demands stronger triage and governance.
NHIMG editorial — based on content published by Aikido: Bug bounty isn’t dead, but the old model is breaking
Questions worth separating out
Q: What breaks when AI floods a bug bounty programme with low-quality reports?
A: Validation capacity breaks first, then remediation planning, then trust in the programme itself.
Q: Why do bug bounty programmes become harder to govern as AI improves report generation?
A: Because AI reduces the effort needed to create plausible submissions faster than internal teams can assess them.
Q: How do you know if a vulnerability disclosure programme is working?
A: It is working when high-quality reports are routed quickly, duplicates are filtered early, and genuine issues reach remediation without overwhelming the team.
Practitioner guidance
- Cap and classify intake volume Set explicit submission thresholds, deduplication rules, and severity gates so AI-generated volume cannot overwhelm the review queue.
- Measure triage saturation directly Track time-to-first-review, time-to-dismissal, and time-to-remediation separately.
- Narrow reward eligibility to higher-signal work Reserve rewards for findings that demonstrate exploitability, chaining potential, or material business impact.
What's in the full article
Aikido's full blog post covers the operational detail this analysis intentionally leaves for the source:
- Interviews and quoted commentary from Daniel Stenberg and Casey Ellis on how the bug bounty model is changing
- Specific examples of how AI increases both report volume and the burden of validation for maintainers
- The rationale behind curl, Node.js, and the Internet Bug Bounty changing or pausing payout models
- The article's view of what kinds of vulnerabilities researchers are likely to pursue next as automation improves
👉 Read Aikido's analysis of why bug bounty is breaking under AI-driven report inflation →
AI-generated bug bounty noise: what security teams need to change?
Explore further
02/08/2026 12:57 pm
Bug bounty is becoming a signal-governance problem, not just a vulnerability programme. The article shows that when report generation becomes cheap, the real scarcity moves to human validation and remediation. That changes the governance question from 'how many findings can we get?' to 'how much decision capacity do we have?' For security leaders, the practical conclusion is that disclosure workflows need queue discipline, ownership rules, and disposition criteria before AI increases volume again.
A question worth separating out:
Q: Who is accountable when disclosure programmes are overwhelmed by report volume?
A: Accountability sits with the organisation running the programme, not the reporters. Security leaders, product owners, and programme managers need explicit rules for intake, validation, and closure. Without that ownership, the disclosure channel becomes an unmanaged workload rather than a security control.
👉 Read our full editorial: Bug bounty is breaking under AI-driven report inflation
