Bug bounty reckoning: AI slop forces enterprise strategy shift | TechTarget
As generative AI tools flood vulnerability intake pipelines with plausible-looking "slop," tech giants are reconsidering the ROI of traditional, paid bug bounty programs. Between external triage exhaustion and the rise of internal automated AI auditing, industry heavyweights like Intel and Google are forcing a rewrite of vulnerability disclosure rules.
What began as isolated adjustments could herald an industry-wide pivot. Earlier this year, Curl creator Daniel Stenberg shut down the project's bug bounty program after being overwhelmed by a flood of LLM-generated false positives.
By mid-September, reports surfaced that Intel had quietly suspended cash rewards for its long-running bug bounty program. Weeks later, on October 1, Google stopped accepting vulnerability reports for its own Open-Source Software Vulnerability Reward Program (OSS VRP), explicitly citing an unsustainable influx of invalid, automated reports.
Together, these moves mark a turning point in vulnerability management. Security teams are facing an asymmetric resource drain in which low-effort...
Copyright of this story solely belongs to www.techtarget.com. To see the full text click HERE
