Archive — US — techcrunch
AI slop and fake reports are exhausting some security bug bounties
The prevalence of low-quality AI-generated bug reports, termed 'AI slop', is overwhelming security bug bounty platforms, as inaccuracies frustrate researchers and companies. Reports often contain fabricated vulnerabilities that mislead cybersecurity efforts. While some platforms like HackerOne are developing AI tools to filter submissions, the challenge of distinguishing real threats from noise continues.
Key points
- AI slop refers to low-quality, LLM-generated reports in cybersecurity that claim to find vulnerabilities that do not exist.
- These false reports are disrupting bug bounty programs by providing misleading data, leading to wasted efforts in identifying real vulnerabilities.
- Security researchers have reported a rise in false positives due to such AI-generated reports, creating confusion in security assessments.
- Platforms like HackerOne are developing AI-assisted systems to improve accuracy in filtering these submissions.
- One open-source developer removed their bug bounty program due to an overwhelming number of AI slop reports.
Why it matters
- The rise of AI in various industries is challenging cybersecurity practices, echoing trends in 2025 where AI is increasingly leveraged in both offensive and defensive measures.
- The issue reflects a broader concern in IT where automation and AI tools can introduce errors, impacting trust and efficiency in software development.
- As AI technology evolves, parallels can be drawn with historical tech trends where initial implementations faced backlash before refinement and trust were achieved.
The growing challenge of AI slop underscores the necessity for improved filtering systems in bug bounty platforms, as the cybersecurity industry adapts to the dual-edged nature of AI in threat detection.