The decline of bug bounty programs like cURL and Nextcloud reflects the challenges posed by AI-generated vulnerability reports, impacting cybersecurity efforts.
Daniel Stenberg, a Swedish programmer and long-time supporter of the cURL library, announced the discontinuation of the bug bounty program on HackerOne in January 2026, a move followed by Nextcloud in April. This shift highlights the evolving landscape of cybersecurity as AI-generated vulnerability reports flood the market, undermining the traditional model that rewards skilled vulnerability discovery.
Historically, cURL and Nextcloud's bug bounty programs incentivized the identification of real vulnerabilities, but advancements in AI have dramatically changed the game. John Morello, CTO of Minimus, revealed that the proportion of legitimate submissions has plummeted from 15% to below 5% due to an influx of AI-generated reports that often lack genuine issues.
Ross McKerchar from Sophos categorized the new wave of submitters into three groups: novices relying on AI without verification, experienced researchers misled by AI, and systematic teams submitting large volumes of reports. In response, HackerOne introduced Hai Triage, an AI system to filter submissions, while Bugcrowd enacted reforms including identity verification and stricter submission rules.
The urgency of the situation was underscored by Anthropic's Project Glasswing, which utilized its Claude Mythos 5 model to autonomously identify vulnerabilities, yielding over 23,000 potential issues from scanned projects—6,202 deemed high or critical priority. Independent verification confirmed over 90% of these findings as real vulnerabilities, highlighting a crisis in the verification process as the speed of discovery outpaces remediation efforts.
Recent trends indicate a shift in the bug bounty economy, with tech giants like Google and Apple increasing rewards for complex vulnerabilities while lowering payouts for simpler issues. This shift is a defensive strategy against a burgeoning shadow market for exploits, where complete attack chains can command millions.
The impending Cyber Resilience Act in the EU, effective September 11, 2026, mandates vulnerability reporting within 24 hours, compounding the challenges for companies overwhelmed by AI-generated submissions. The gap between vulnerability discovery and exploitation is shrinking, with AI models capable of identifying critical vulnerabilities faster than human teams can respond.
The cybersecurity sector is witnessing a fundamental shift, where the primary challenge has shifted from discovery to verification and remediation. As AI continues to advance, the need for human oversight in validating findings becomes increasingly critical, underscoring a broader trend across various industries where AI outpaces human capacity for verification.
