Overview
Bug bounty programs face rising volumes of low-effort and AI-generated reports lacking PoCs or real impact — prompting static payouts, signal gates, and VIP tiers for deep researchers.
Timeline
- 2026-10-01: google-oss-vrp pauses product vulnerability submissions — “vast majority” of automated AI reports invalid (2026-10-04-google-vrp-official-x-post)
- 2026-01: curl discontinues bug bounty over AI-generated low-quality reports
- 2026-07-22: github restructures HackerOne program effective July 27 (2026-07-23-github-bug-bounty-restructure-vip)
- 2026-05: GitHub raised submission standards (PoC/impact)
Key Players
Analysis
Public rate cuts + VIP upside reframes quality relationships. Fairness depends on backlog grandfathering and clear VIP criteria.