AI Is Flooding Bug Bounty Programs—And Rewriting the Rules of Vulnerability Hunting

Ten years ago, bug bounty programs were a novelty. Companies like Apple were just beginning to pay researchers for reporting security flaws—starting with a $200,000 top reward in 2016, then climbing to $1 million by 2019, and $2 million last year. That era of steady escalation is now being upended by AI.

Agentic AI models can now autonomously scan code, identify vulnerabilities, and even generate exploit code. The result: a flood of submissions that is overwhelming both corporate security teams and independent researchers. Joseph Thacker, an independent security researcher who uses AI in his own work, says he’s submitted three times more bugs this year than last. “Google is probably spending two to ten times as much on payouts,” he notes. “Tech giants can handle that pressure. Most companies can’t.”

Google’s Threat Intelligence Group recently confirmed what many suspected: attackers are using AI to discover zero-day vulnerabilities. Chief analyst John Hultquist called it “our first evidence that it is happening.” Criminal actors, he warns, could become far more dangerous if they gain access to zero-days at scale.

The bounty economy is already shifting. The Curl project shut down its HackerOne program in January after being deluged with low-quality AI submissions, though founder Daniel Stenberg later noted that quality has since improved. Google overhauled its Chrome and Android reward programs in April, lowering payouts for some bug classes while raising them for others. Linux creator Linus Torvalds recently called the security mailing list “almost entirely unmanageable” due to AI-generated noise.

Some experts argue that higher payouts alone won’t solve the problem. “You can’t patch your way out of this,” says longtime security engineer Niels Provos. “You need to build infrastructure that makes as many bugs as possible irrelevant.” For organizations without Google-scale resources, that advice may be the only viable path forward.