AI slop and fake reports are coming for your bug bounty programs

TechCrunch reports growing concern over AI-generated “slop” in bug bounty ecosystems—LLM-fabricated vulnerability reports that look credible but lack real impact—creating noise for platforms and maintainers. Examples include fake submissions to open-source projects and a surge in overall report volume, with perspectives from RunSybil, HackerOne, and Bugcrowd; Mozilla notes no significant increase in invalid reports. The industry is testing human-plus-AI triage approaches, such as HackerOne’s Hai Triage, to reduce false positives, flag duplicates, and prioritize genuine findings.