AI impact on bug bounty ecosystems

AI slop security reports are clogging up Apple's bug bounty program

No separate article for this desk or language yet.

Meta, Microsoft, Apple, and Crypto.com paid out at least $58 million in bug bounties in 2025.

In 2025, Meta, Microsoft, Apple, and Crypto.com paid out at least $58 million in bug bounties.

HackerOne and Nextcloud suspended paid bug bounty programs in April 2024 due to AI-generated noise.

In April 2024, HackerOne and Nextcloud suspended their paid bug bounty programs. The suspension was prompted by an influx of AI-generated noise affecting the programs.

Anthropic introduced the cyber-focused Mythos model in March 2024 under Project Glasswing.

In March 2024, Anthropic introduced Mythos, an AI model specifically focused on cybersecurity. This release was conducted under Project Glasswing and was initially restricted to researchers, banks, and selected technology companies.

During internal testing, the model demonstrated significant capabilities, such as surfacing 271 vulnerabilities within Firefox, according to reports from Mozilla. Additionally, Apple has been utilizing AI tools like Claude Mythos under Project Glasswing to detect security flaws in its own software.

Bugcrowd reported a quadrupling of vulnerability submissions, mostly fake, in March 2024.

In March 2024, the security platform Bugcrowd reported a significant spike in vulnerability submissions. Over a three-week period, these submissions more than quadrupled compared to previous levels.

According to reported findings, the majority of these reported vulnerabilities were identified as being fake.