If AI is truly making it easier to find security bugs in code (which it appears to be doing), then it makes sense that bug bounty programs may be far less willing to pay a lot of money for a single bug report. From El Reg:
"Finding vulns just doesn't pay like it used to. At least one bug hunter who found an open source security flaw and reported it months ago via HackerOne's backlogged Internet Bug Bounty (IBB) program finally got paid for his work - but at a drastically reduced reward rate. The security researcher found a medium-severity vulnerability that previously paid $1,843. As of Monday, HackerOne's IBB pays $297 for the same severity level. Similarly, the new IBB cash prize for a critical vulnerability is $2,257, compared to the previous $9,250 reward. High-severity bugs now fetch $1,009, while they used to earn a $4,429 payout. And low-severity bugs earn researchers $68, compared to the previous $597 reward."
Not to say that AI has somehow stopped the beg bounty madness. I seem to get more unbidden bug reports from researchers these days than ever, and half the time the bugs are fixed "in the cloud" w/out much notice or fanfare (or CVEs).
https://www.theregister.com/security/2026/05/21/hackerone-takes-an-axe-to-its-bug-bounty-rewards/5244458
BrianKrebs
npub1rf…5t9xk
2026-05-22 12:33:40 UTC
Author Public Key
npub1rfdvtvmesnz7x7s3hjg5q2dgrup9xfh209gvj36angljrfy5edtq25t9xkSeen on
wss://relay.ditto.pubPublished at
2026-05-22 12:33:40 UTCEvent JSON
{
"id": "34f8e260ec2b06d7ae3af0b77280c4c47650b8771ae801f05150a728ae17f49b",
"pubkey": "1a5ac5b37984c5e37a11bc914029a81f025326ea7950c9475d9a3f21a494cb56",
"created_at": 1779453220,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/users/briankrebs/statuses/116618246234272623",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "If AI is truly making it easier to find security bugs in code (which it appears to be doing), then it makes sense that bug bounty programs may be far less willing to pay a lot of money for a single bug report. From El Reg:\n\n\"Finding vulns just doesn't pay like it used to. At least one bug hunter who found an open source security flaw and reported it months ago via HackerOne's backlogged Internet Bug Bounty (IBB) program finally got paid for his work - but at a drastically reduced reward rate. The security researcher found a medium-severity vulnerability that previously paid $1,843. As of Monday, HackerOne's IBB pays $297 for the same severity level. Similarly, the new IBB cash prize for a critical vulnerability is $2,257, compared to the previous $9,250 reward. High-severity bugs now fetch $1,009, while they used to earn a $4,429 payout. And low-severity bugs earn researchers $68, compared to the previous $597 reward.\"\n\nNot to say that AI has somehow stopped the beg bounty madness. I seem to get more unbidden bug reports from researchers these days than ever, and half the time the bugs are fixed \"in the cloud\" w/out much notice or fanfare (or CVEs).\n\nhttps://www.theregister.com/security/2026/05/21/hackerone-takes-an-axe-to-its-bug-bounty-rewards/5244458",
"sig": "ea5cefcfe0de1bce082d6c83c3bec5fc5f9f71597f911fcec11680b0efde8b613bf283fd8a1f5f3504dd37c292844c3848542473e1994c594e99a8a951f495a8"
}