Swedish programmer Daniel Stenberg has been supporting cURL for almost thirty years. This library is crucial for data transmission across billions of devices, from routers to automotive firmware. For the past two years, much of his work has involved analyzing vulnerability reports generated by AI for various white-hat hackers. While these reports sounded convincing, they typically lacked actual vulnerabilities. In January 2026, Stenberg announced the closure of the bug bounty program on HackerOne. Nextcloud followed suit in April, shutting down their program as well.
ForkLog investigated how the traditional model supporting the cybersecurity industry is breaking down and how this process will impact other segments of the economy.
AI Overload Wins
The cURL and Nextcloud bug bounty programs operated on a simple premise: find a vulnerability, report it to the vendor, and receive a reward. The economy relied on the fact that finding vulnerabilities is a rare and skilled task, naturally limiting the number of submissions to those capable of doing it. Advanced AI models have managed to remove this limitation in just a few months.
John Morello, CTO of cybersecurity firm Minimus, shared a statistic with industry publications that illustrates the impact of the rise of AI-generated reports in cybersecurity:
“The share of genuine submissions has dropped from about 15% to less than 5%.”
The rest are plausibly formatted reports without real vulnerabilities, generated by AI faster than analysts can reject them.
Ross McKerchar, Director of Information Security at Sophos, has categorized the market for vulnerability submissions into three types of submitters:
- Novices who run code through AI models and submit results without verifying whether they represent real vulnerabilities or mere hallucinations;
- Experienced researchers misled by AI agents: the AI convincingly reports a problem that doesn’t exist, and the human trusts it;
- Teams (the most systematic type) that have built a pipeline of mass submissions using AI agents, focusing on volume rather than accuracy.
In July 2025, HackerOne, the largest bounty platform, announced Hai Triage, an AI-based system designed to filter out generated submissions before they reach a live analyst.
In March 2026, Bugcrowd implemented extensive reforms to combat the influx of AI-generated reports. These included mandatory identity verification, dynamic submission rate limits, CAPTCHA, and strict blocking rules: from a 30-day account suspension for 10 consecutive rejected reports to a permanent ban for automated spam and mass submissions of fake vulnerabilities.
In this context, the decisions by cURL and Nextcloud appear not as capitulation, but as a rational response to an economy that has ceased to function.
No Turning Back
The scale of the problem became evident after an experiment by Anthropic.
In April, the company introduced Claude Mythos 5, a model capable of autonomously finding zero-day vulnerabilities and writing working exploits for them. Following this, along with about fifty partners, Anthropic launched Project Glasswing, which tests critical software using this LLM.
The results were significantly better than the industry’s forecasts for the coming years.
From over a thousand scanned OS projects, the model identified 23,019 potential issues, with 6,202 classified as high or critical priority. Independent firms verified a sample of 1,752 findings, with over 90% confirmed as real vulnerabilities. In the first weeks of operation, Anthropic and its partners discovered over ten thousand high and critical-level loopholes in system-critical software.
Out of this array, specialists managed to fix less than 1%.
Source: Anthropic.This level of “effectiveness” has triggered a crisis. Vulnerabilities in code have always existed; their sheer number is not the main news. The news is that the speed of discovery has, for the first time in software history, outpaced the ability of teams to verify, prioritize, and patch these findings.
The capabilities of Mythos 5 are illustrated by three vulnerabilities:
- A 27-year-old vulnerability in OpenBSD (considered one of the most secure OS), allowing remote crashes of any server running this system;
- A 16-year-old vulnerability in FFmpeg — a video technology used by Netflix and browsers. It went undetected by five million automated tests;
- A chain in the Linux kernel that grants an attacker full control over the device.
Due to such results, neither Claude Mythos 5 nor a similar model, GPT-5.5-Cyber from OpenAI, has received a public release yet. Before releasing a tool that finds vulnerabilities faster than any human, the industry needs to address at least some of the holes that the AI has identified in testing.
Source: OpenAI.At this stage, a pattern emerges that will likely manifest far beyond cybersecurity in the coming years. AI radically accelerates production — of code, content, legal documents, and in this case, vulnerabilities — but does not reduce costs on the other end of the chain, where findings need to be verified, tested, and patched without risking production halts.
Demand for Exclusivity
AI overload has collapsed the old bug bounty economy: mass superficial reports have devalued simple vulnerabilities, while money is rapidly flowing towards complex, rare, and verified exploits.
In May, Google reduced base rewards for memory errors in Chrome to $500 and eliminated bonuses for simple read/write bugs. To retain top researchers, tech giants are forced to pay unprecedented premiums for polished Proof-of-Concepts:
- In October 2025, Apple raised the cap for hidden access to the iOS kernel from $1 million to $2 million. When a vulnerability is found in beta software, total payouts for reports, including all bonuses and bypassing Lockdown Mode, can reach $5 million;
- In August 2025, Microsoft launched the large-scale Zero Day Quest contest with a total of $5 million in prizes, introducing a 100% multiplier for hacking the AI infrastructure of Copilot and Azure;
- In May 2026, Google increased the reward for a zero-click exploit tied to the Titan M chip (Pixel) to $1.5 million. For comparison, the bonus was $1 million in April.
This generosity from IT giants is not charity but a defensive measure against the shadow market of private brokers like Crowdfense and Operation Zero. In these companies, a complete attack chain for current versions of iOS or Android can fetch up to $7 million.
As a result, all participants in the vulnerability market are now hunting for a small group of engineers whose ability to assemble complex exploits by hand is worth millions compared to cheap automation.
This is Just the Beginning
The industry has had no time to gradually adapt to the new pace of vulnerability discovery — regulators have not allowed it.
On September 11, 2026, one of the EU's most demanding provisions — the Cyber Resilience Act — will come into effect, mandating incident and vulnerability reporting. From that day forward, any company selling connected products in the European market, regardless of physical registration, must report actively exploited bugs. Submissions must be sent to designated organizations within 24 hours of discovery. The penalty for non-compliance can reach €15 million or 2.5% of the company’s global annual revenue, whichever is greater.
The law requires vendors to maintain a functioning channel for receiving and processing vulnerability reports — the very mechanism that is overwhelmed by AI-generated submissions. While cURL could afford to close its bug bounty program relying on an active community of volunteers, a corporation selling software in the EU does not have that option. This is the first part of the problem.
The second part is the asymmetry between attack and defense, which is growing faster than the most pessimistic scenarios. The window between discovering a vulnerability and its exploitation, which used to be measured in weeks and months, can now shrink to minutes.
The problem is not limited to top LLMs: the AI cybersecurity company Aisle has shown it can reproduce findings from Anthropic using much older and cheaper models.
In an experiment, researchers extracted specific code fragments with vulnerabilities from Anthropic's demonstrations and ran them through small, open models, including compact ones with 3.6–5.1 billion active parameters.
As a result, with the right context and proper support (agent scenarios, parallel verification), even inexpensive neural networks succeeded in detecting key vulnerabilities, including findings at the CVE-2026-4747 level from Anthropic's cases.
In the near future, this issue will likely hit open-source software the hardest. Mythos 5 has already identified thousands of high-severity vulnerabilities in every major OS and browser in its sample. At the current pace of AI progress, such capabilities will spread further — including among players not bound by commitments to “responsible disclosure.” Developers without legal departments and budgets for large-scale patching will be the first to feel the pressure.
Bug bounty programs, regulatory norms, and the structure of the cybersecurity industry were designed for a world where the main problem was discovery. That world ended in April 2026. The new bottleneck is verification, prioritization, and patching. Who will bridge this gap is a question that neither vendors nor regulators have answered yet.
The crisis in cybersecurity is the first visible symptom of a more fundamental shift: AI is producing findings on a scale unimaginable three years ago, while humans remain the only link capable of verifying these findings and turning them into closed vulnerabilities. A similar dynamic is already emerging in the legal field, where neural networks generate drafts of lawsuits and contracts faster than lawyers can proofread them, and in content production, where resources for moderating and fact-checking vast amounts of generated information are lacking.
Across all sectors, a division of labor is emerging between humans and machines: AI produces the product — code, documents, texts. The specialist is left with what cannot be scaled by prompts — the responsibility for quality.