AI vulnerability report flood forces Internet Bug Bounty to suspend awards

The Internet Bug Bounty has suspended awards after a wave of AI-assisted vulnerability reports overwhelmed its triage process. The move is the latest sign that security teams are having to adjust to a new reality: large language models can help researchers find flaws faster, but they can also generate far more submissions than humans can realistically review.

The program is one of the long-running channels used to encourage responsible disclosure of security bugs. In practice, that means researchers report issues privately, vendors or maintainers verify the claim, and rewards are paid when the report is valid and useful. That model works best when the number of submissions stays within the capacity of the people doing the checking.

According to reporting by The Register, the recent surge was driven in part by AI tools used to assist vulnerability research. Some of these tools help with code review, pattern matching, and fuzzing, the automated testing of software with unexpected inputs. Others are used to draft reports, which can make it easier to file large volumes of findings quickly, even when many of them turn out to be duplicates, low quality, or not security issues at all.

That creates a problem for bounty operators. Every report still needs to be read, sorted, and verified by a human, and that review work takes time. If the number of submissions rises faster than the available staff can process them, the whole program slows down, reward decisions get delayed, and the cost of running the bounty rises.

The broader security industry is seeing the same pressure. Teams that handle vulnerability disclosure, both in open source and commercial software, have reported a jump in AI-generated or AI-assisted bug reports. Some are legitimate discoveries that would have taken longer to find manually. Others are noisy or badly formed, but still consume review time because they have to be checked before they can be dismissed.

That shift is changing the economics of disclosure. Bug bounty programs were designed around the assumption that finding and reporting bugs was hard enough to keep volume manageable. AI lowers that barrier, which is useful for defenders, but it also means maintainers can be flooded with more material than their existing triage process was built to handle.

The Internet Bug Bounty suspension does not mean the concept of bug bounties is broken. It does show that the people running these programs now need stronger filtering, clearer submission rules, and more automated pre-screening before a human reviewer gets involved. Without that, even a well-run program can end up spending most of its time sorting through reports instead of fixing real problems.

For developers and security teams, the pressure is no longer just about finding vulnerabilities faster. It is also about deciding which of the many AI-assisted reports are worth the attention they require, and which ones are just another item in an already crowded queue.