A decade ago, Apple’s top bug bounty payout was $200,000. By 2024, it hit $2 million. Now, the whole model is breaking under the weight of AI-generated vulnerability reports. The shift isn’t gradual—it’s a supply shock.

Agentic AI models can now autonomously find software flaws and craft exploits. This has flooded disclosure programs with reports, both high-quality and garbage. Independent researcher Joseph Thacker says he’s submitted three times more bugs this year than last. His prediction: Google’s payout costs will multiply 2–10x. But he adds, “Tech giants can handle that pressure. Most companies can’t.”

The economics are shifting. The Curl project killed its HackerOne bounty in January after drowning in low-quality AI submissions. Linux’s security mailing list became “almost unmanageable” per Linus Torvalds. Yet Daniel Stenberg of Curl reported a surprising turnaround: “We stopped getting AI slop. Now we get an ever-increasing amount of really good security reports.” Quality is up, but volume is crushing teams.

Google responded by overhauling its Chrome and Android bounty programs in April—lowering payouts for common bugs, raising them for high-impact finds. The 90-day disclosure window, a hard-won standard, is collapsing. Security researcher Himanshu Anand wrote, “That window was built for a world where bug finders were rare and exploit development was slow. LLMs compressed both timelines.”

Attackers are adapting faster. Google’s Threat Intelligence Group recently observed cybercriminals using AI to discover a zero-day in an open-source admin platform and bypass two-factor authentication. Chief analyst John Hultquist called it “our first evidence that it’s happening.” He warns that criminal actors—not just nation-states—will exploit these capabilities, making patch cycles even more urgent.

Some argue the solution isn’t faster patching but better architecture. Longtime engineer Niels Provos puts it bluntly: “You can’t patch your way out of this. You need to build infrastructure that makes as many bugs as possible irrelevant.” As AI reshapes both offense and defense, the real engineering challenge is shifting from finding bugs to designing systems that survive them.

Source: Wired