The funeral that nobody scheduled
Bug bounty is dead. The industry has not scheduled the funeral because scheduling a funeral requires admitting a death occurred and admitting a death occurred is bad for the quarterly investor update.
A researcher I work with delivered the autopsy in a single Discord message. Not a whitepaper. Not a 200-page industry analysis with infographics and a foreword from a partner who has never read a bug report. One sentence from someone who reads submissions every day:
“Some AI subs are genuinely valid and good finds, generally who are good at finding stuff are even better with AI, and script kiddies have now turned into agentic kiddies.”
Script kiddies are an extinct species. They did not evolve into better hackers. They evolved into better prompt writers. The selection pressure did not reward understanding. It rewarded the ability to configure a language model that has never read source code and could not pass a CTF designed for middle schoolers.
Nine out of ten
Submissions are up 900 percent year over year. For every one report your triage team processed last year, ten arrive now. Nine of them were generated by a machine.
The nine cite CWE identifiers with professional formatting. The nine reference OWASP categories by number. The nine include a “steps to reproduce” section that sounds authoritative and describes a vulnerability that does not exist in the codebase. The nine were written by a system that has been trained on every public vulnerability report ever published and has learned to模拟 the shape of a finding without ever understanding what a finding actually is.
Curl’s maintainer shut down his bounty program. Not paused. Not restructured for efficiency. Murdered. Daniel Stenberg, who maintains one of the most deployed pieces of software in the history of computing, wrote a public blog post explaining that being flooded with machine-generated hallucinations was taking a serious mental toll. A man whose software runs inside every Linux distribution on the planet had to explain to the industry that drowning in garbage makes him sad. The industry responded by sending him more garbage.
The middle class eviction
AI did not damage security researchers. AI performed a hostile corporate acquisition of the entire profession and terminated the middle management layer.
The top ten percent got measurably better. HackerOne marketing calls them “bionic hackers” because tech companies cannot resist putting a superhero adjective on things. These researchers train custom models on their own exploit patterns and direct AI toward novel logic flaws that no unassisted human could identify at speed. HackerOne paid a record 81 million dollars in 2025. The feast at the top is historically unprecedented and the attendees are not sharing.
The bottom transformed into agentic kiddies. They prompt Claude. They configure agents to mass-scan every public codebase with a bug bounty program. They auto-submit whatever the model produces. The marginal cost per submission is zero dollars and zero effort. At a 95 percent invalidity rate, the 5 percent of submissions that accidentally describe a genuine vulnerability make the operation cash flow positive. This is not security research. This is running an arbitrage strategy against human triage capacity. The triage team is the exchange. The agentic kiddies are the market makers. The market is collapsing.
The middle ceased to exist. The competent auditor who identified reentrancy patterns for fifty thousand dollars a year is now an API call. EVMBench demonstrated GPT-5 autonomously exploiting 72.2 percent of known vulnerabilities. Six months prior the figure was 31.9 percent. Draw the slope with a ruler and ask yourself what profession looks like a good career investment for the next decade.
The spreadsheet says growth
Nobody in a position of authority wants to solve this because the crisis presents as a growth narrative on every dashboard that matters.
“Submission volume up 900 percent year over year” appears on the investor deck in 40-point font next to a hockey stick chart. “95 percent of submissions are machine-generated hallucinations with zero security value” appears on a different slide in 12-point font that the presenting partner skips because the meeting is already running over and the refreshments are getting warm.
Bugcrowd raised 102 million dollars. HackerOne raised 64 million. If you operate a bounty platform and AI multiplies your submission metric by ten, that is a growth story. The triage team drowning in hallucinated vulnerability reports is an operational expense category. The open source maintainer publishing a blog post about his declining mental health is a task for the communications department. Nothing in the compensation structure of any executive at any platform rewards reducing noise. Everything rewards increasing volume.
The submitters need money. The platforms need metrics. The protocols need security. These three vectors form a triangle that has never pointed the same direction and the AI wave is widening every angle. Every stakeholder is optimizing for their own objective function and the objective functions do not intersect at “correct vulnerability reports.”
I read the hallucinations
I triage bug bounty submissions at a major security platform. I have consumed more AI-generated vulnerability reports than most humans have consumed tweets. I can identify a hallucinated exploit from the opening sentence because I have read three thousand of them and they all open the same way.
I watched a language model generate a reentrancy attack against a contract that contains zero external call instructions. The model described the exploit path in seven steps. Steps one through six were technically coherent. Step seven required the attacker to call back into the contract from a function that the contract does not have. The model invented the function. The model invented the callback. The model invented the entire second half of the exploit and presented it with the confidence of someone announcing they have discovered extraterrestrial life.
The model has never known it was wrong about this or about anything. Wrongness was not in the design requirements. The engineers who built the model do not know everything the model does not know. They are, at this moment, presenting keynote talks about AI safety to audiences who also do not know.
I built a bot to filter this before it reaches a human. Seven agents in a pipeline. It outperforms every triager I have ever worked with. It also manufactures attacks requiring the EVM to execute opcodes that were never added to any version of the specification, in any fork, in any testnet, in any fever dream of a core developer. On a single submission it will produce a brilliant observation about a vulnerability I overlooked and then immediately assert that the attacker can drain the protocol by exploiting a Solidity keyword that does not exist. Same confidence level. Same formatting. Same professional tone.
I verify every output. The hallucination rate drops every week. Eventually it crosses below the human error rate. On that day the bot becomes the primary triager and I become the escalation contact for edge cases. The software I built to reduce my workload will become my supervisor. The bots are filtering outputs generated by other bots while we all build increasingly sophisticated weapons for different factions in the same recursive war. None of us know which faction is winning. None of us know what winning means in this context.