GitHub Bug Bounty — AI Slop Broke Security Economics

GitHub’s restructured bug bounty program went live on July 27, 2026, cutting the maximum public critical payout from $30,000 to a fixed $10,000 — a 67% reduction. Higher rewards now live behind an invite-only VIP tier, accessible only to researchers with a track record of accepted findings. The stated reason is blunt: AI-generated vulnerability reports overwhelmed the triage pipeline, and the old model could not survive the volume.

TL;DR

• What: GitHub split its bug bounty into a public tier (max $10,000 critical) and an invite-only VIP tier (max $30,000+ critical), effective July 27, 2026
• Why: AI-generated vulnerability reports made open programs economically unsustainable — Bugcrowd’s triage queue grew 334% in three weeks, almost entirely slop
• Precedent: curl killed its paid bounty in January 2026 after confirmed-vulnerability rates fell below 5%
• Risk: Reputation gating locks out legitimate new researchers while narrowing the pool of eyes on GitHub-hosted code

What Happened — Two Tiers, One Message

The new payout structure is straightforward. Public researchers — anyone who signs up — now receive fixed amounts: $250 for low-severity findings, $2,000 for medium, $5,000 for high, and $10,000 for critical. No negotiation, no variable ranges. The VIP tier, gated by invitation based on past accepted findings, retains the old rates: $1,000 low, $7,500 medium, $20,000 high, $30,000 or more for critical vulnerabilities.

Before this change, the public critical range was $20,000–$30,000+. The new fixed $10,000 is not a modest adjustment — it is a structural message. GitHub is telling the open research community: we cannot afford to pay top dollar for an open door when 95% of what walks through it is noise.

Alongside the payout restructure, GitHub adopted HackerOne’s signal requirement. New researchers can submit up to four initial reports while establishing credibility. After that, continued access depends on demonstrated quality. This is a direct response to what Bugcrowd’s team started calling “sloptimism” — AI-generated reports submitted quickly and hopefully, where the submitter trusts the model’s output more than actual exploit evidence.

The four-submission cap for newcomers means a first-time researcher who hits two false positives early may be locked out before finding a real vulnerability. The system punishes learning curves, not just spam.

Why This Matters

The GitHub restructure is not an isolated decision. It is the highest-profile confirmation that AI-generated noise has fundamentally broken the economics of open bug bounty programs.

The triage cost asymmetry is the core problem. Generating a plausible-looking vulnerability report with an LLM is nearly free — a few minutes and a decent prompt. Reviewing, reproducing, and disproving that report still costs a human engineer their full attention. When Bugcrowd tracked a three-week stretch in March 2026, their triage queue grew by more than 334%, almost entirely from low-quality AI-generated submissions. The math does not work: if 19 out of 20 reports are junk but each one takes 30 minutes to disprove, you have burned an entire engineering week to find one real bug.

curl proved the pattern six months earlier. Daniel Stenberg ended curl’s paid HackerOne program on January 31, 2026, after the confirmed-vulnerability rate fell from its historical ~15% to below 5%. The cash incentive was the attractor for slop, not genuine curiosity. When curl returned to HackerOne in March — without a bounty — the confirmed rate recovered to 15–16% by April. The lesson was unambiguous: remove money, remove spam. But it also removes motivation for the careful, skilled researchers who do the hardest work.

Stenberg’s experience illustrates the human toll that aggregate statistics obscure. Even after killing the bounty, curl’s 2026 report volume has been running well above prior years. The sheer volume — even unpaid — led Stenberg to take a weeks-long hiatus from vulnerability intake in July, accepting zero reports while the small team recovered. When the maintainer of one of the most widely deployed libraries on the planet needs an extended break from security reports, the system is structurally broken.

The uncomfortable dual reality is that AI is simultaneously productive and destructive in this space. HackerOne’s own data shows valid AI-found vulnerabilities rose 210% year-over-year in 2025. Prompt-injection findings specifically were up 540%. AI is genuinely discovering real bugs that humans missed. The problem is not capability — it is the ratio. For every valid AI-assisted finding, there is a torrent of confidently wrong submissions that cost more to disprove than the real findings are worth.

GitHub can afford to build a reputation-gated VIP program. They have the infrastructure, the data, and the budget to maintain two tiers. Most open-source maintainers cannot. curl is maintained by a small team. The Linux kernel’s security process is already strained. Smaller projects — the kind that host on GitHub and depend on community researchers — have no mechanism to distinguish signal from noise at scale. The GitHub restructure protects GitHub. It does nothing to protect the thousands of projects hosted on GitHub that face the same problem without the same resources.

If you maintain an open-source project with a bug bounty, track your confirmed-vulnerability rate monthly. When it drops below 10%, the bounty is attracting more noise than signal. Consider curl’s approach: remove the cash, keep the channel open, and re-evaluate quarterly.

This matters beyond security research because the pattern generalizes. Any system built on human validation — code review, content moderation, peer review, customer support — faces the same collapse when AI makes plausible-looking submissions nearly free. Bug bounties just hit the wall first because the feedback loop is tightest: submit report, get money. The exploit is obvious, and the exploiters arrived exactly on schedule.

The Take

The GitHub bug bounty restructure is the clearest signal yet that AI tooling does not just affect what developers build — it breaks the trust infrastructure developers depend on. Every public security program is now a tragedy-of-the-commons problem, and the standard fix — reputation gating — creates a second problem that nobody wants to talk about.

Reputation gating locks out genuinely new researchers. The four-submission HackerOne cap sounds reasonable until you consider that security research is a field where early work is messy, where false positives are part of learning, and where the next great researcher has not published anything yet. A narrower pool of vetted eyes on GitHub means a narrower pool of eyes on every codebase hosted there. That is not a theoretical risk — it is a direct reduction in coverage.

I do not think GitHub had a better option. The old model was bleeding money and engineer time. But the industry should be honest about what was traded: accessibility for sustainability. The researchers who get locked out of VIP tiers will not simply try harder. Some will stop. Others will find less scrupulous buyers for their findings. The vulnerability market does not have a quality filter — it has a price filter, and GitHub just lowered the legitimate price while the black market holds steady.

The action item for teams that depend on external security research: stop treating bug bounties as your vulnerability detection strategy. They are a supplement, not a substitute. Invest in internal security tooling, automated scanning, and — yes — AI-assisted code review on your own terms. The era of cheap, open, high-quality crowdsourced security research is over. What replaces it will be more expensive and less democratic.