Bug Bounty Platforms Drowning in AI Slop—Curl and Nextcloud Already Pulled the Plug
Bugcrowd reports submissions surged 334% in three weeks as AI-generated fake vulnerability reports flood platforms. Curl and Nextcloud ended their paid programs. The signal-to-noise crisis is here.
In Brief
- Bugcrowd reports submissions surged more than 334% in just three weeks this March — most of them AI-generated and false
- Curl and Nextcloud have already shut down their paid bug bounty programs over AI slop, and more projects are expected to follow
- Some security firms are reportedly using Bugcrowd’s triage as free reinforcement learning training data, violating its terms of service
The bug bounty model that has powered vulnerability discovery for over two decades is buckling under the weight of AI-generated junk. Ars Technica reports that platforms paying hackers to find software flaws are being inundated with low-quality AI submissions, forcing some to suspend programs entirely.
Bugcrowd, whose customers include OpenAI, T-Mobile, and Motorola, said reports it received more than quadrupled over a three-week period in March, with most proving to be false. The platform coined a term for the trend: “sloptimism” — overly optimistic reports submitted with minimal to no validation. Three sources drive the flood: firms training AI systems on live targets using Bugcrowd triage as reinforcement learning signals (a terms-of-service violation), AI-assisted novices submitting unverified findings, and automated pipelines generating bulk submissions from common templates.
The damage is already measurable. Curl suspended its paid bug bounty program in January, citing a surge in low-quality AI-generated reports. Curl subsequently resumed HackerOne submissions in March 2026, and by April the project reported that the slop situation was no longer a problem. Nextcloud followed in April, suspending paid rewards on its HackerOne program for the same reason. Curl creator Daniel Stenberg wrote that the “never-ending slop” had taken “a serious mental toll to manage,” since every AI-generated report still requires a human to verify it.
Ross McKerchar, chief information security officer at Sophos, told the Financial Times that the surge in poor-quality AI reports was rapidly becoming a serious issue. He predicted that bug bounty programs would persist but would need to evolve. Google’s program, which disbursed $17 million last year, has not yet publicly changed its policies, but AI-discovered vulnerabilities are also proving genuinely valuable when wielded by experienced researchers. The problem is separating signal from noise — and the noise is getting louder. Bugcrowd has updated its policies to penalize sloptimism submissions, but the fundamental tension remains: AI lowers the barrier to entry for bug hunting while simultaneously drowning the humans who must triage the results.
FAQ
What is “AI slop” in bug bounty programs?
AI slop refers to vulnerability reports generated by AI tools without manual verification. These reports are often templated, lack reproduction steps, and contain speculative impact assessments. Bugcrowd calls this “sloptimism” — submissions driven by AI optimism rather than genuine security findings.
Which bug bounty programs have closed due to AI slop?
Curl suspended its paid HackerOne bug bounty program in January 2026 (resuming submissions in March). Nextcloud followed in April 2026, suspending paid rewards on its HackerOne program. Both cited overwhelming volumes of AI-generated false reports that made the programs unsustainable.
Are AI-discovered vulnerabilities ever real?
Yes. Experienced researchers using AI tools have found genuine vulnerabilities, including Anthropic’s Mythos AI discovering a 27-year-old OpenBSD bug. The issue is not AI itself, but the flood of unverified AI-generated submissions that overwhelm triage teams.
