AI-Generated Reports Overwhelm Bug Bounty Programs, Prompting Some Suspensions
Similar Articles
AI Models Accelerate Bug Discovery Across Major Software Systems
Mozilla Details AI Tool That Found 271 Firefox Security Flaws in Two Months
AI Compute Costs Now Exceeding Employee Salaries in Some Companies
AI Firms Brief Congress on Advanced Cybersecurity Models and Risks
Anthropic Faces Growing Pains Amid Rapid Growth and IPO Speculation
Companies that pay for software flaw discoveries are being inundated with a high volume of low-quality reports generated by Artificial Intelligence (AI). Bugcrowd, a major platform, saw reports more than quadruple in a three-week period, with most being false. This surge has led at least one program, for the data transfer tool Curl, to suspend its paid bounty due to an 'explosion in AI slop reports'.
Facts First
- Bug bounty programs are receiving a high volume of low-quality reports generated by Artificial Intelligence (AI).
- Bugcrowd's report volume more than quadrupled over three weeks in March, with most reports being false.
- Curl suspended its paid bug bounty program in January due to an 'explosion in AI slop reports' and decreased quality.
- Google's bug bounty program disbursed $17 million last year, up from $7.5 million in 2021.
- The increase in poor-quality submissions comes from both amateurs and existing researchers who are 'sometimes getting led on by the [AI] agents,' according to a security officer.
What Happened
Bugcrowd reported that the number of vulnerability reports it received more than quadrupled over a three-week period in March. Most of these reports were false. The data transfer tool Curl suspended its paid bug bounty program in January, citing an 'explosion in AI slop reports' and a decrease in submission quality. Ross McKerchar of Sophos stated that the increase in poor-quality submissions comes from both amateur researchers and existing researchers being led on by AI agents.
Why this Matters to You
If you use software from major companies, the effectiveness of their security testing could be impacted. A flood of AI-generated false reports may slow down the process of identifying and fixing genuine, critical vulnerabilities. This trend could also make it harder for legitimate security researchers to get paid, potentially reducing the incentive to find real flaws.
What's Next
More bug bounty programs may need to adjust their review processes or implement new filters to manage the influx of AI-generated reports. This could lead to delays in processing legitimate submissions. The industry may develop new guidelines or tools to help distinguish between human and AI-generated vulnerability research.