AI-generated fake bug reports flood bounty programs
Generative AI tools are flooding bug bounty platforms with fake and low-quality vulnerability reports, overwhelming platform operators and forcing some companies to suspend their programs. The surge, driven by amateurs, misled professionals, and automated spammers, forces tech companies to spend hours debunking hallucinated findings.
What happened
Generative AI tools are flooding bug bounty platforms with automated, low-quality, and fake vulnerability reports. Bugcrowd reported that submissions more than quadrupled over a three-week period in March, with most proving false. HackerOne saw submissions jump 76% in the year to March, but genuine vulnerability reports remained at 25%.
The surge comes from three groups: amateurs using AI chatbots to write reports for non-existent flaws, professionals misled by AI assistants providing flawed data, and automated spammers using end-to-end scanning systems to mass-produce fake submissions. Curl suspended its bug-bounty programme in January citing an 'explosion in AI slop reports'.
Reported impact
Tech companies participating in bug bounty programs must spend hours debunking hallucinated code and false submissions. The volume of low-quality reports has forced some organisations to shut down their payout programs entirely.
Index analysis
The incident reflects how AI systems trained to generate reports can produce content that mimics legitimate submissions but lacks factual basis, overwhelming human review processes designed for smaller volumes of vetted submissions.
Governance controls
HackerOne introduced an AI-based validation system for sorting through high volumes of findings and automated submissions to address the flood of spurious reports.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.