Bug bounties in the Mythos era

This report explains how AI is reshaping bug bounty programs—producing both a surge of low-signal automated submissions and rapidly improving capabilities that can surface validated, high-severity vulnerabilities—summarizes Sophos’s 2025 bounty metrics and program changes, and recounts past incidents (Asnarök, Personal Panda) where zero-days were exploited and suspicious bounty submissions appeared, arguing for stronger evidence requirements, automated validation, and program guardrails in the ‘Mythos’ era.