The “vulnpocalypse” is reshaping the bug bounty industry, driving down prices for mid-tier vulnerabilities and putting independent researchers who rely on these payouts at risk. The surge of AI-powered vulnerability reports has flooded platforms with submissions, leading to increased triage times and decreased payout amounts.
For years, large language models (LLMs) have been used to automate vulnerability discovery, resulting in a massive influx of bug reports. Bug bounty operators like HackerOne, Bugcrowd, and TrendAI’s Zero Day Initiative (ZDI) have seen submission volumes skyrocket, with some reporting increases as high as 450% year-over-year. This has put a strain on the industry’s ability to process and pay out for vulnerabilities.
As a result, many bug bounty operators are struggling to keep up with the demand. HackerOne CEO Kara Sprague notes that report volume has roughly doubled year-over-year, while Bugcrowd CEO Dave Gerry reports a submissions spike of over 300% during a three-week period earlier this year. However, volumes have since moderated.
The increased competition and flooding of low-quality “slop” reports has led to a decrease in payout amounts for mid-tier vulnerabilities. According to Wojciech Reguła, a bug researcher, bounty amounts have gone down significantly, with some paying as little as $1,000 for what would previously be worth $5,000 or more.
The AI-powered triage system that many platforms are implementing aims to filter out low-quality reports and prioritize the most critical vulnerabilities. However, this has not alleviated the concerns of researchers who rely on bug bounties to make a living. Ashish Kunwar, vulnerability researcher at GanaSec, notes that the entire pipeline from submission to payout has slowed down significantly, making it increasingly difficult for independent researchers to survive.
The impact of the vulnpocalypse is far-reaching and threatens to reshape the bug bounty ecosystem. While some argue that this will not kill the industry, it will undoubtedly change the way companies approach bug bounties. The price of vulnerabilities will likely continue to decrease, and the value of mid-tier vulnerabilities may become scarce or undervalued.
For independent researchers who rely on bug bounties, this means adapting to a new reality where payouts are lower and competition is fierce. It’s essential for these individuals to diversify their skills, stay up-to-date with industry trends, and explore alternative revenue streams. As the vulnpocalypse continues to reshape the bug bounty landscape, it will be interesting to see how companies and researchers adapt to this new normal.
In light of this development, we recommend that researchers and companies take a closer look at their bug bounty programs and adjust their strategies accordingly. This may involve implementing AI-powered triaging, providing more comprehensive training for researchers, or re-evaluating the value placed on mid-tier vulnerabilities. By doing so, they can ensure that the vulnpocalypse does not spell disaster for the bug bounty industry as a whole.
Source: Dark Reading — 2026-08-28