Bug Bounties in 2026: When AI Slop Costs More Than the Bugs

In the opening sixteen hours of a January 2026 work week, the maintainers of curl, the open-source data-transfer tool that ships inside billions of phones, cars, servers, and games consoles, received seven security reports through HackerOne. Not one described a real vulnerability. By the middle of that month the team had triaged more than twenty submissions and confirmed nothing. On 21 January, curl’s creator Daniel Stenberg announced the end of the project’s bug bounty, a program that had paid out more than $100,000 across 87 confirmed vulnerabilities in its lifetime, because the labor of reading the noise had finally overrun the value of the signal.

Crypto spent the past five years building the most generous bug bounty market in software, with advertised ceilings that reach $16 million and a record single payout of $10 million. That market now faces the same problem that broke curl, only with more money on the table and far more to lose. In 2026 the flood of AI-generated slop, reports that are confident, well-formatted, and wrong, has inverted the economics of paying whitehats. When only 4% of the reports reaching a major exchange are worth anything, the question stops being how large a bounty should be and becomes whether a public bounty is worth running at all. This is the story of how crypto’s payout tables got redrawn, who is cutting rewards and who is raising the bar, and what curl’s strange second act reveals about what a bounty was really paying for.

The Anatomy of Slop

A large language model, pointed at a codebase and told to find vulnerabilities, will produce a document that looks exactly like a real report: a plausible title, a severity rating, a numbered set of reproduction steps, and a confident claim of impact. The only thing missing is the bug. The reproduction steps do not reproduce anything, the code path is imaginary, or the described exploit is actually the software behaving as intended. Security firm Bugcrowd gave the pattern a name in 2026, calling it sloptimism, which it defined as reports generated quickly and hopefully, where the author trusts the model more than the underlying evidence.

curl’s own numbers show how fast the ground gave way. Stenberg wrote that in previous years, somewhere north of 15% of submissions ended up as confirmed vulnerabilities; starting in 2025, he said, the confirmed rate plummeted to below 5%, meaning more than nineteen of every twenty reports were junk. He blamed an explosion in AI slop reports and, more pointedly, a bad-faith attitude among reporters chasing rewards rather than trying to improve the software. Bugcrowd distilled the whole crisis into a single sentence: generation got cheap, but validation did not. That asymmetry is the entire problem. A model can manufacture a convincing report in seconds; a human triager still needs half an hour to prove it false.

The point is not that AI cannot find real bugs. It can, and it increasingly does. The point is that the cost of generating a plausible-looking false positive has fallen to nearly zero, while the cost of disproving one has not moved. When submitting costs a spammer nothing and reading costs a defender real time and money, the math that made public bounties work for a decade quietly breaks.

The Signal Collapse, in One Table

The slop flood is not a curl-specific complaint. The same collapse in signal shows up wherever a program accepts unsolicited reports, and the shape is consistent: volume spikes, valid-report rates crater, and triage teams drown. The table below gathers the numbers that programs disclosed across the first half of 2026.

Two of those rows deserve a caveat. HackerOne has reported that valid, AI-assisted findings rose too, by roughly 210% year over year in its 2025 data, so the machines are not purely a source of noise. And Bugcrowd’s 334% spike came in a single concentrated window, not as a steady state. But the direction is unmistakable. The ratio of signal to noise has fallen far enough that several programs decided the old reward structure was subsidizing the wrong behavior.

Coinbase Redraws Its Reward Table

On 29 July 2026, Coinbase did what a crypto exchange almost never does in public: it made its bug bounty cheaper. In an update to its HackerOne program, the exchange removed rewards for low- and medium-severity vulnerabilities outright, cut its high-severity payout from $15,000 to $6,000, and slashed critical payouts from $50,000 to $15,000. For a company that has spent years positioning security as a core brand promise, cutting the top reward by 70% is a striking move.

Coinbase was explicit about the cause. During the first half of 2026, it said, 44% of closed reports were duplicates, 37% were informative but not exploitable, and 15% were invalid; just 4% led to a payout. The share of reports that turned into a paid finding had fallen from 14% in 2024 to 4% in the first half of 2026, and the exchange warned that inbound report volume could triple as cheap AI tooling spreads. In its own words, AI has changed who, or what, finds a commodity vulnerability, and it has changed how fast and how cheaply that can happen. The logic is blunt: if a class of finding can now be mass-produced by a bot, it is no longer scarce, and scarcity is what a bounty is supposed to pay for.

The timing was not a coincidence. Coinbase cut its table two days after GitHub cut its own. In the space of a single week in late July 2026, two of the most visible bounty programs in tech and crypto both decided that paying flat rates for commodity bugs no longer made sense.

GitHub Cuts the Public Purse

On 27 July 2026, GitHub restructured its bug bounty, cutting public payouts by at least half and replacing its old reward ranges with a single flat figure for each severity: $250 for low, $2,000 for medium, $5,000 for high, and $10,000 for critical. The larger money did not disappear, it moved behind a wall. GitHub created an invitation-only tier, reserved for researchers with a proven track record, where top rewards can reach around $30,000. In effect, the public program became an entry-level funnel and the real budget migrated to a vetted elite.

GitHub was not first, or alone. It was the fourth major program to restructure, suspend, or narrow its scope during 2026, joining Google, Bugcrowd, and HackerOne’s own Internet Bug Bounty, which paused new submissions under the same pressure. The table below traces the wave.

Read as a group, these are not six isolated policy tweaks. They are the same institution, the open bug bounty, reaching the same conclusion from six directions at once: a program that pays a flat rate to anyone who submits is now a program that pays to be spammed.

Google Raises the Bar Instead of Cutting Pay

Not every program answered the flood by cutting the check. Google took the opposite tack. On 19 March 2026 it revamped its bug bounty programs without banning AI outright. Instead, it raised the evidence bar. For memory-corruption reports in the top two tiers of its Open Source Software program, Google now demands exact reproduction steps against its fuzzing harness or an already-merged patch, the sorts of proof that a hallucinated report cannot fake. It also rebalanced its bigger programs, lifting Android rewards while trimming some Chrome payouts, steering money toward the categories where human insight still beats a language model.

The philosophical split matters. Cutting payouts, as Coinbase and GitHub did, lowers the prize so that spraying cheap reports stops being worth anyone’s time. Raising the bar, as Google did, keeps the prize but makes the ticket to claim it expensive, since only a genuine, reproducible finding clears the gate. Both approaches try to restore the same broken ratio; they just tax a different side of the transaction. The crypto platforms that handle the largest sums, as we will see, ended up leaning on the second approach, because in their world the prizes are simply too large to shrink away.

Why Crypto Is the Worst Place for a Slop Flood

If cheap slop is drawn to money, crypto is where the money is. The industry runs the largest bug bounties in software. In April 2025 the stablecoin protocol Usual posted a $16 million ceiling on Sherlock, described at the time as the largest bug bounty in tech history, and the record for an amount actually paid still belongs to the $10 million that Wormhole handed a researcher known as satya0x in 2022. Uniswap and LayerZero have advertised ceilings in the same league. Those numbers are precisely the kind of headline that draws a speculative bot operator to point a model at a contract and fire off a report on the off chance of a jackpot.

The stakes on the other side are just as extreme. Immunefi’s mid-2026 accounting found that crypto projects lost around $972 million across 207 incidents in the first half of the year, the highest incident count ever recorded, even as total losses fell below a billion dollars. On-chain theft is usually irreversible, which is why bounties exist at all: paying a whitehat is almost always cheaper than eating the loss. That severity sits on top of a threat surface that keeps widening, as flash loans, cross-chain bridges, the invisible tax of MEV, and the new logic introduced by smart-account wallets each open fresh classes of bug. Crypto therefore sits at the exact intersection the slop flood punishes hardest: the biggest prizes and the biggest losses, in the same place.

The $20,000 Median Behind the $16 Million Headline

The ceilings are a mirage for almost everyone. Immunefi’s own research on hundreds of long-running programs found that the median critical payout is just $20,000, even though the mean is $114,355 and the platform has paid $107.3 million in critical awards over its life. Roughly one in five confirmed reports is rated critical. The gap between the $16 million headline and the $20,000 reality is not a scandal; it is a distribution with a very long tail, where a handful of enormous payouts sit atop a broad floor of ordinary ones.

That shape is exactly what makes crypto bounties a magnet for slop. A rational spammer does not need to believe any single AI report is valid. If generating one costs almost nothing, and even a $20,000 hit is life-changing in much of the world, the expected value of spraying hundreds of speculative reports at programs advertising seven- and eight-figure ceilings can look positive, right up until the platform makes submitting expensive. The same Immunefi research spells out why defenders keep paying anyway: the median hack it estimates a critical bounty prevents involves $2.2 million in direct theft, the average is $24.5 million, the median token drops 61% within six months, and 84% of projects never recover. Against that, a $20,000 check is not generosity, it is insurance priced at a steep discount. The problem in 2026 is that the discount now comes bundled with a mountain of noise.

Immunefi’s Answer: Make Submitting Expensive

Crypto’s largest bounty platform never relied on an open front door, and that design is paying off now. Immunefi, which says it counts more than 92,000 registered researchers, protects over $180 billion across more than 650 protocols, and has helped prevent more than $25 billion in losses, gates submissions in ways that make casual spam costly. It requires a working proof of concept for high-severity claims, runs mandatory know-your-customer checks before any large payout, escrows funds, and arbitrates disputes between researcher and project. A report that cannot demonstrate impact does not advance, no matter how confidently it is written.

That friction is the crypto-native version of Google’s raise-the-bar strategy, and it kept the platform functional through the flood: Immunefi paid roughly $13.45 million across 837 valid bugs in the first half of 2026. The proof-of-concept requirement is the load-bearing wall. A language model can describe an exploit; it is far harder to make it hand over a script that actually drains a testnet fork of a contract. Requiring the exploit, not the essay, is how a program built for the world’s largest bounties keeps a bot from cashing them. It is worth remembering that a bounty is only one layer of a defense stack that also includes audits, formal verification, and operational controls like well-designed multisig custody; the payout is what catches whatever slips past the rest.

The Triage Arms Race

If generation got cheap, defenders are trying to make validation cheaper too, largely by pointing machines back at the machines. HackerOne rolled out an AI triage system in mid-2025 that uses language understanding to spot duplicates and flag likely-invalid submissions, distinguishing reports that describe the same bug in different words from genuinely distinct findings. It is AI deployed against AI slop, an arms race conducted entirely by models, and it rhymes with the broader industry push toward verifiable AI, where the output of a model has to be provable rather than merely plausible.

Bugcrowd went further and made bad submissions carry a personal cost. In March 2026 it added mandatory identity verification once a researcher hits a report threshold, 30-day suspensions for accounts that file ten consecutive invalid reports, permanent bans for submission farming, and anti-squatting rules for newly launched programs. The design goal is to reintroduce scarcity on the submission side: if firing off slop can get your verified identity suspended, the free option stops being free. Coinbase’s cuts, Immunefi’s proof-of-concept gate, and Bugcrowd’s suspensions are three doors into the same room, each trying to restore the price that AI stripped out of submitting a report.

curl’s Second Act: Why the Money Was the Magnet

The most revealing experiment of the year was accidental, and it happened at curl. When Stenberg killed the cash bounty at the end of January 2026, he did not stop accepting reports; he simply redirected them to unpaid private disclosure through GitHub and removed the money. What followed was the opposite of what the doom narrative predicted. By April, curl’s reports were arriving at roughly twice the 2025 rate, yet the confirmed-valid share had recovered to around 15% to 16%, back near its pre-slop norm and up from the sub-5% low of the paid period. Stenberg noted that almost every report now appeared AI-assisted, and that most of them were genuinely good.

The lesson is uncomfortable for anyone who assumed a bigger bounty always buys better security. Removing the cash did not scare off serious researchers; it scared off the spammers, because the reward was the magnet. Once there was no jackpot to chase, the bad-faith submitters that Stenberg had complained about had no reason to point a model at curl and hit send. What remained were people using AI as a real tool to do real work. That does not mean crypto should abolish its bounties, since crypto’s whitehats are defending live funds and deserve to be paid for it. But it reframes the design question. A payout does not only reward good findings; it also advertises a prize to everyone, including the people who will fabricate a finding to claim it. The trick in 2026 is to pay for signal without broadcasting a bounty that pays for volume.

The Two-Tier Future and the Whitehat Squeeze

Add the moves together and a structure comes into focus. Public programs are becoming vetting funnels with modest, flat rewards, while the real budgets migrate to invitation-only tiers for proven researchers, whether that is GitHub’s new VIP band or Immunefi’s elite All Stars cohort. In a world where anyone can generate a report, reputation becomes the scarce asset, and platforms are pricing it accordingly. For the top few hundred researchers, this is good news: less noise to compete against and larger, more exclusive purses.

For everyone below that line, it is a squeeze, and it echoes the wider yield compression reshaping how crypto pays its contributors. Cutting public payouts and hiding the top rates behind an invite raises a real question about where the next generation of whitehats is supposed to earn its reputation, if the entry-level ladder now pays $250 for a low-severity bug and gates the serious money. There is also an incentive tail worth naming plainly. When the median bounty is $20,000 and the theft it prevents can run to eight figures, shrinking the honest payout while a black-hat exit stays enormous nudges the marginal, underpaid researcher in exactly the wrong direction. Whitehats watch which programs pay and which do not, and a program that underpays a justified finding is running a reputational risk that no triage bot can fix.

The Legal Backdrop: Safe Harbor and the SEC

Bounties are not just an economic instrument; they are a legal one. Unsolicited probing of a live system can run into the US Computer Fraud and Abuse Act, so a bounty program functions as written permission, a promise that a good-faith researcher who follows the rules will be paid rather than prosecuted. Industry-wide frameworks such as the Security Alliance’s whitehat safe harbor try to standardize that promise for crypto, giving researchers a clearer path to return funds and disclose without becoming a defendant. Slop does not change that legal calculus, but it does make programs rewrite their terms, tightening scope and eligibility so the safe harbor is not accidentally extended to a bot operator spraying junk.

The regulatory overhang is distinctly American here. The SEC still treats many tokens as securities, which complicates who may receive a large payout and how KYC and sanctions screening apply before funds move, one reason Immunefi’s identity checks are not optional. And the enforcement environment that makes disclosure risky in the first place, explored in HOGE Wire’s look at the crypto enforcement gap, is precisely why a credible, well-funded bounty remains valuable: it is the legal off-ramp that turns a would-be attacker into a paid defender. Weaken the payout too far and that off-ramp narrows.

The Bottom Line: Paying for Signal, Not Volume

The through-line of 2026 is that a bug bounty was never really paying for reports; it was paying for signal, the scarce, verified knowledge that a specific exploit exists before an attacker uses it. Cheap generative AI severed the link between a report and that signal, and every program in this story is trying to reattach it, whether by cutting the price of noise, raising the proof required, gating submitters behind identity and reputation, or, in curl’s case, removing the cash magnet entirely. Jack Sanford, co-founder of the audit contest platform Sherlock, has argued that point-in-time audits were never meant to carry the entire burden of security, and the same is now true of bounties: they are one instrument in a portfolio, not a magic checkbook.

For crypto, which has the field’s largest prizes and its most irreversible losses, the adjustment is unavoidable. Expect more proof-of-concept requirements, more invite-only tiers, more identity friction, and fewer flat rewards for commodity findings that a model can now mass-produce. The whitehats who thrive will be the ones who use AI to do deeper, verifiable work rather than to manufacture volume, and the programs that thrive will be the ones that pay generously for that work while making slop expensive to submit. Generation got cheap. In 2026, crypto is learning to pay for the one thing that did not.

Frequently Asked Questions

What is AI slop in bug bounties?

AI slop refers to vulnerability reports generated by a language model that look professional, with plausible titles, severity ratings, and reproduction steps, but describe bugs that do not actually exist. Bugcrowd calls the behavior sloptimism: submitting AI output quickly and hopefully, trusting the model more than the evidence. In 2026 the flood of such reports pushed valid-bug rates below 5% at some programs, because generating a fake report is nearly free while disproving one still takes a human triager real time.

Why did Coinbase cut its bug bounty payouts in 2026?

Coinbase cut rewards on 29 July 2026 because AI had turned commodity vulnerability reports into something that could be mass-produced cheaply. The exchange said only 4% of reports led to a payout in the first half of 2026, down from 14% in 2024, with the rest split among duplicates, unexploitable findings, and invalid claims. It removed rewards for low and medium severity, cut high-severity payouts from $15,000 to $6,000, and reduced critical payouts from $50,000 to $15,000.

What is the largest crypto bug bounty ever paid?

The largest bounty crypto has ever paid is $10 million, awarded to a researcher known as satya0x for responsibly disclosing a critical flaw in the Wormhole bridge in 2022. The largest advertised ceiling is higher: the stablecoin protocol Usual posted a $16 million maximum on Sherlock in 2025, described as the largest bug bounty in tech history. Most payouts are far smaller, however, with the median critical bounty on Immunefi sitting at roughly $20,000.

Does using AI to find bugs get you banned from bug bounty programs?

Using AI as a research tool is generally allowed and increasingly common; roughly two-thirds of researchers report using AI or automation in their workflow. What gets penalized is submitting unverified AI output. Bugcrowd added identity checks, 30-day suspensions for accounts that file ten consecutive invalid reports, and permanent bans for submission farming, while Google now demands exact reproduction or a merged patch for top-tier findings. The line is between AI-assisted work that proves a real bug and AI slop that does not.

Why is the median crypto bug bounty only $20,000 when ceilings reach $16 million?

Bounty payouts follow a long-tailed distribution: a small number of enormous awards sit atop a broad floor of ordinary ones. On Immunefi the median critical payout is about $20,000 while the mean is $114,355, pulled upward by rare seven-figure hits. The multi-million-dollar ceilings are marketing signals meant to attract elite researchers to the highest-value protocols, not the amount a typical valid report earns. That gap between the headline and the reality is part of what draws speculative AI spam toward the biggest advertised prizes.

Anneke de Vries is HOGE Wire’s security desk editor, covering exploits, audits, and the economics of crypto defense.