AI bug bounty: AI hunters, AI slop, and what it means for your program

AI now works on both sides of bug bounty. AI agents submit real, paid findings, and AI-written false reports have pushed at least one major open-source project to end its bounty.

For a company, the question is practical: will AI hunters bring you more valid bugs, or more triage work? This page gives the public numbers, the platform rules and a table to decide between a program and a scoped test.

What have AI hunters found so far?#

The best-known case is XBOW, an AI pentest company. In June 2025 it wrote that its system had reached the top of HackerOne's US leaderboard after submitting nearly 1,060 vulnerabilities.

Its own status breakdown is the useful part:

Read it both ways. Programs resolved or triaged 433 reports, so the system found real issues at scale. Duplicates, informative and not-applicable closures add up to 453, so programs also spent time closing reports that led nowhere. XBOW also wrote that its security team reviewed every finding before submission, to comply with HackerOne's policy on automated tools, and that one program removed it for not allowing "automatic scanners".

A second, smaller case is a guest post on the ClickHouse blog by an engineer who hunted in ClickHouse's C++ code with AI for six months. He reports finding "a few real vulnerabilities", mostly out-of-bounds reads and writes. He also writes that the models "always returned very convincing findings" that were often false, and that he spent 3 to 4 hours per finding on manual checks and the report.

What is AI slop, and why did curl end its bounty?#

AI slop is a report that an AI tool wrote and nobody checked: invented functions, code that does not compile, impact that is not there. Each one still takes a maintainer's time to disprove.

The curl project ran a bug bounty on HackerOne from April 2019. Its maintainer wrote that it paid for 87 confirmed vulnerabilities and over 100,000 US dollars. In earlier years, more than 15% of submissions were real. In 2025 the rate fell below 5%: "Not even one in twenty was real."

The program stopped taking bounty submissions on 31 January 2026. Reports now go to GitHub private vulnerability reporting or by email, with no reward. The stated reason is to remove the money that drives "made up lies". The post blames three trends together: AI slop, weaker human reports, and reporters who want to "poke holes rather than to help".

What do HackerOne's rules say about AI?#

HackerOne's Code of Conduct permits AI and sets limits on how it is used. As of November 2026 it says:

• AI tools are allowed across the research workflow. The researcher stays responsible, must validate findings and must include a reproducible proof of concept.
• Hackbots "must not operate in a fully autonomous manner". People must "investigate, validate, and confirm" each vulnerability before it is submitted.
• Prohibited use of AI includes large volumes of low-signal reports, unverified or fabricated claims, and reports with "hallucinated or misleading technical details".
• Large-scale submission of low-quality or unverified reports, including AI misuse, gets a final warning first, then a 12-month ban, then a permanent ban.

Program rules sit on top of these. A program can ban automated tools, cap request rates or narrow scope.

Should you run a bug bounty, a scoped test, or both?#

Decide by what you need to show and how much triage you can absorb. AI hunters raise both the number of valid reports and the number of reports to close.

Many companies do both: a scoped test first, so the obvious bugs are gone before outside hunters arrive, then a program for ongoing coverage. No standard sets that order; it is a cost and noise decision.

How do you triage reports that AI may have written?#

Apply the same evidence rule to every report, whoever or whatever wrote it:

1. Ask for a reproducible proof of concept against your system, with the exact request and response.
2. Check that every file, function, endpoint and version in the report exists.
3. Reproduce the effect from a second account or session before you accept impact.
4. Close reports that only quote a scanner or a model's reasoning, with no observed effect.
5. Track the valid-report rate per reporter, and use the platform's sanctions for repeat slop.

These are the same checks we apply to our own AI testing agents. The false-positives guide lists nine of them, and how to evaluate an AI pentest report turns them into a scorecard.

Where a scoped AI-assisted test fits#

A scoped test covers what a bounty often skips: second roles, signed-in workflows and the list of what was not tested. Our AI testing agents work inside written scope and tool rules, and Excession Labs checks each finding's evidence before it reaches the report. The production safety page has the rules. The sample report on excessionlabs.ai, the main site of Excession Labs, which also runs this site, shows what each finding contains.