Bug bounty businesses bombarded with AI slop

Imagine being flooded with hundreds of bug reports, but most of them are just noise — generated by AI trying to game the system. That’s exactly what’s happening now, according to Jamie John writing in the Financial Times. Companies like Bugcrowd, which work with giants like OpenAI and T-Mobile, saw a quadrupling of reports in just three weeks this spring — most of which turned out to be false alarms. The rise of powerful AI tools means anyone with some coding skills can produce seemingly legitimate bug reports, but they’re often just junk. This flood of low-quality submissions is forcing some businesses to hit pause on their bug bounty programs, worried they’re wasting time and resources chasing shadows. As Jamie John points out, it’s a major headache for security teams trying to sift through the spam, and it highlights a new challenge — how to tell real vulnerabilities from AI-generated fluff. So what does this mean? Well, this wave of AI spam might just reshape how companies run their bug programs, pushing them to find smarter ways to filter the signal from the noise. That shift is subtle now, but it’s exactly the kind of signal that usually defines the next cycle.