AI Slop Is Turning Bug Bounty Programs Into A Security Liability

Ido Geffen, CEO and Co-founder, Novee Security.

​Bug bounty programs have traditionally relied on human researchers to identify cybersecurity vulnerabilities, with submission volumes that security teams could generally manage.

There were always strong reports and weak ones, but the weaker submissions were often easy to spot. They were thin, poorly written or obviously misunderstood the environment, so an experienced analyst could simply reject them quickly.

AI is changing both the volume of reports and how easily teams can distinguish legitimate findings from noise. A bad report today might look carefully analyzed, technically plausible and full of detail—and still be wrong. The “AI slop” phenomenon is not limited to creative disciplines such as writing and design. It’s all too rampant in cybersecurity as well.

That can make things expensive. Analysts now have to take more time to investigate—reading the report, reproducing the claimed issue, understanding it in the context of the application, assessing whether it’s actually exploitable and deciding where it belongs against other risks—before discovering that there’s nothing there. A researcher can file a report in minutes, while the team receiving it pays in hours.

HackerOne reported in May 2026 that the industry experienced a 100%-plus surge in report volume after more advanced AI models and tools arrived in February. The new volume includes valuable findings alongside duplicates, unverifiable submissions and reports lacking enough depth to act on.

Bug bounty programs were designed around human researcher attention as the scarce resource. AI is changing where that scarcity sits.

The Scarcity Has Shifted

curl’s experience also shows that AI can improve vulnerability research. The deeper problem is economic. The cost of generating a plausible hypothesis has fallen, while the cost of proving whether it represents real risk remains high.