# HackerOne Slashed Bug Bounties by 76% — Because AI Won't Stop Finding Bugs **URL:** \ **Category:** News & Articles\ **Tags:** hacking, earn-money, tips-tricks, ai, news\ **Created:** [June 11, 2026, 4:46pm UTC](https://onehack.st/t/hackerone-slashed-bug-bounties-by-76-because-ai-wont-stop-finding-bugs/322960 "2026-06-11T16:46:15Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Aina](https://onehack.st/user_avatar/onehack.st/aina/32/167469_2.png) [@Aina](https://onehack.st/u/Aina)\ **Post date:** [June 11, 2026, 4:46pm UTC](https://onehack.st/t/hackerone-slashed-bug-bounties-by-76-because-ai-wont-stop-finding-bugs/322960/1 "2026-06-11T16:46:15Z")
# 🐛 HackerOne Slashed Bug Bounties by 76% — Because AI Won’t Stop Finding Bugs _The Internet Bug Bounty program that paid hackers to secure open-source code just hit the brakes — AI made bugs TOO easy to find_ **A critical vulnerability that used to earn you $9,250 now pays $2,257. Low-severity bugs dropped from $597 to $68. The program that’s been running since 2012 and paid out over $1.5 million just told researchers: we’re pausing submissions.** Between you and me, this is the most predictable disaster in the history of bug bounties. AI tools got so good at finding vulnerabilities that the people running [HackerOne’s Internet Bug Bounty program](https://hackerone.com/ibb) basically said “we can’t fix bugs as fast as machines find them.” So instead of scaling up their fix game, they scaled down YOUR paycheck. ![Bug Bounty Pause](https://media.giphy.com/media/077i6AULCXc0FKTj9s/giphy.gif) * * * > **🧩 Dumb Mode Dictionary** > > | Term | What It Actually Means | > | --- | --- | > | **Bug Bounty** | Companies pay hackers cash for finding security holes in their software — legal hacking for money | > | **Internet Bug Bounty (IBB)** | A specific program on HackerOne that pays for bugs found in open-source software everyone uses (like web servers, programming languages) | > | **HackerOne** | The biggest platform where companies list bounties and hackers submit bugs — think eBay for security research | > | **Open Source** | Software where the code is free and public — anyone can read it, use it, or find holes in it | > | **Vulnerability** | A weakness in code that someone could use to break in, steal data, or cause damage | > | **Remediation** | Actually fixing the bug after someone finds it | > | **Critical/High/Low Severity** | How dangerous a bug is — critical = someone can take over your whole system, low = minor annoyance | > | **AI-Assisted Research** | Using AI tools to automatically scan code and find security bugs instead of doing it manually | > **🔍 How We Got Here** > > The Internet Bug Bounty program has been around since 2012. It was one of the good ones — funded by big tech companies to pay independent researchers who found bugs in open-source software that literally the entire internet depends on. > > Then AI happened. > > Tools like AI code scanners started finding vulnerabilities at a rate no human team could match. HackerOne’s own statement said it plainly: _“AI-powered research is expanding the scope of vulnerability discovery and improving the comprehensiveness and speed of discovery.”_ > > → More bugs found → not enough developers to fix them → system overloaded → program paused on **March 27, 2026**. > > The cruel part? The bugs are real. They’re not hallucinations (well, most of them aren’t). There’s genuinely more broken code than anyone can patch. > **📉 The Receipts — Bounty Price Massacre** > > | Severity | **Old Payout** | **New Payout** | **% Cut** | > | --- | --- | --- | --- | > | 🔴 Critical | $9,250 | $2,257 | **-76%** | > | 🟠 High | $4,429 | $1,009 | **-77%** | > | 🟡 Medium | ~$2,000 | ~$500 | **~-75%** | > | 🟢 Low | $597 | $68 | **-89%** | > > That low-severity cut is _diabolical_. Sixty-eight dollars. For finding a real security flaw in software used by millions of people. You’d make more money returning shopping carts at Walmart. > > Source: [HackerOne IBB program page](https://hackerone.com/ibb) > **💥 The Domino Effect** > > It’s not just HackerOne’s IBB. The ripple hit fast: > > - **Node.js** — the JavaScript runtime that runs half the internet’s backends — [paused its own bug bounty program](https://www.developer-tech.com/news/ai-code-scanners-halt-internet-bug-bounty-payouts/) because their funding came through HackerOne’s IBB pipeline. Gone. > > - **cURL** — the command-line tool installed on literally every computer on earth — had already suspended their bounty earlier because of an _avalanche of garbage AI-generated reports_. Their maintainer Daniel Stenberg has been vocal about AI researchers submitting “vulnerabilities” that don’t actually exist. > > - **Other open-source projects** are watching this closely. If the IBB model collapses, the incentive structure for securing free software collapses with it. > > The pattern: AI floods → maintainers drown → bounties shrink → real researchers leave → software stays broken. Beautiful cycle. > **🗣️ What The Community's Saying** > > The security research community is… not happy: > > - Researchers who spent years building skills to find real bugs are now competing against $20/month AI subscriptions that spray-and-pray thousands of reports > - Open-source maintainers (mostly volunteers, by the way) are getting buried under AI-generated reports — many of which are false positives or duplicates > - Some researchers argue HackerOne is using AI as an excuse to cut costs while their [private enterprise programs](https://www.hackerone.com/) (for companies like Google, Microsoft, etc.) still pay top dollar > - The gap between what a Fortune 500 company pays for bugs vs. what open-source gets is now **absurd** — Google pays $250,000+ for a Chrome sandbox escape while IBB pays $2,257 for a critical bug in software Google depends on > > The vibe: _if AI can find it, it’s not worth paying a human for._ > **⚠️ Why This Actually Matters (Even If You Don't Hunt Bugs)** > > Open-source software runs _everything_. Your bank. Your hospital. Your phone. The servers behind every app you use. > > The Internet Bug Bounty was one of the few financial incentives keeping independent researchers looking at this code. Without it: > > - Bugs pile up unfixed in software like OpenSSL, Apache, nginx, Python, Ruby, PHP > - Nation-state hackers (who don’t need bounty money) still find and stockpile these bugs > - The window between “bug discovered” and “bug exploited” gets shorter while the “bug fixed” timeline gets longer > > → More known-but-unfixed vulnerabilities in critical infrastructure → more breaches → your data. > > This isn’t theoretical. It’s supply-and-demand economics applied to the security of the entire internet. * * * #### Cool. So AI Killed the Bounty Hunter’s Paycheck… Now What the Hell Do We Do? ( ͡° ͜ʖ ͡°) ![Hacking Use Case](https://media.giphy.com/media/YQitE4YNQNahy/giphy.gif) > **🕳️ The Triage Gatekeeper** > > Here’s the angle nobody’s working yet: open-source maintainers are drowning in AI-generated bug reports they can’t sort through. Most are garbage. Some are real. Nobody has time to tell the difference. > > Here’s what you do: position yourself as a **bug report triage service**. You take the flood of incoming AI reports, verify which ones are real, write proper reproduction steps (which AI reports never include), and hand maintainers a clean list. Charge per validated report or monthly retainer. > > The play works because maintainers will pay to NOT read 200 junk reports a week. And YOU can use AI to pre-filter the AI reports (yes, fighting AI with AI) — but the human verification step is where the value is. > > 🧠 _Example:_ A 24-year-old security student in Kraków, Poland builds a triage bot using [Semgrep](https://semgrep.dev/) + manual review. She partners with 3 mid-size open-source projects on GitHub, charges $800/month each for verified-only reports. The projects save their maintainers 15+ hours a week. She scales to 10 projects in 2 months. > > > 📈 **Timeline:** First client in 5-7 days (cold-email maintainers who publicly complain about AI spam on Twitter/GitHub). Saturates at ~15 projects before you need to hire. Window lasts until platforms build this in natively — probably 6-9 months. > **🎰 The Bounty Arbitrage Flip** > > HackerOne’s IBB pays $2,257 for a critical open-source bug. But private programs on the same platform pay $15,000-$250,000 for bugs in software that _uses_ that same open-source code. > > Here’s what you do: find a critical bug in an open-source library. DON’T submit it to IBB. Instead, figure out which major company uses that library in production → submit it to THEIR private bounty program as a supply-chain vulnerability. Same bug. 10x-50x the payout. > > The trick is mapping which companies use which open-source dependencies. Tools like [Socket.dev](https://socket.dev/) and [deps.dev](https://deps.dev/) make this trivial — you can see exactly which Fortune 500 apps depend on which open-source packages. > > 🧠 _Example:_ A researcher in São Paulo finds a deserialization bug in a popular Python library. IBB would pay $2,257. He checks deps.dev, finds it’s used in Shopify’s backend. Submits to Shopify’s HackerOne program → gets $15,000. Same afternoon’s work, different mailbox. > > > 📈 **Timeline:** First successful flip in 2-3 weeks (depends on your existing bug-hunting skill). This play has existed quietly but the 76% IBB cut makes it the obvious rational move. Works indefinitely — companies always pay more to protect their own brand than to protect “the commons.” > **📡 The False Positive Hunter** > > AI bug scanners are generating MASSIVE amounts of false positives — reports that look like real vulnerabilities but aren’t. This is the #1 complaint from maintainers like cURL’s Daniel Stenberg. > > Here’s what you do: build a database of confirmed false-positive patterns from AI scanners. Categorize them by tool (CodeQL, Semgrep, Snyk, etc.) and by false-positive type. Sell access to this database as a filter layer that companies plug into their CI/CD pipelines (the automatic testing system that runs when developers push code). > > Nobody’s done this yet because the AI-generated bug report flood is only ~6 months old. The data doesn’t exist in a structured form anywhere. > > 🧠 _Example:_ A DevSecOps guy in Bangalore, India scrapes public GitHub issues tagged “false positive” + “security” across 500 repos. He categorizes 3,000+ patterns into a filterable dataset, packages it as a [GitHub Action](https://github.com/features/actions) that auto-closes matching reports. Charges $49/month per repo. Gets 40 repos in the first month through Product Hunt and Hacker News launches. > > > 📈 **Timeline:** Data collection takes 1-2 weeks. MVP filter takes another week. First paying customers within a month. This gets more valuable over time as AI scanners evolve and create new false-positive patterns. Defensible for 12-18 months until big players (Snyk, GitHub) build it in. > **🪟 The Patch Window Sprint** > > When IBB paused, a bunch of bugs were already submitted but not yet fixed. Some of these bugs are now _known_ (researchers posted them) but _unpatched_ (no one’s being paid to fix them). This creates a dangerous window. > > Here’s what you do: monitor the [IBB program’s disclosed reports](https://hackerone.com/ibb/hacktivity) for bugs that are public but unpatched. Write the patches yourself. Submit PRs to the open-source projects. Then reach out to companies that use those projects and offer paid security consulting to help them assess exposure. > > You’re not selling the bug — you’re selling the FIX and the expertise around it. Companies will pay because their compliance teams (SOC2, ISO 27001) require them to address known vulnerabilities. > > 🧠 _Example:_ A freelance security consultant in Lagos, Nigeria finds 5 disclosed-but-unpatched IBB bugs in popular PHP libraries. She writes patches, submits PRs, and emails the security teams of 20 African fintech companies that use those libraries. Three hire her for $3,000 each to audit their full dependency tree. Total: $9,000 from bugs that IBB would’ve paid $340 for (5 × $68 low-sev). > > > 📈 **Timeline:** Start scanning disclosed bugs today. First PR within 48 hours. First consulting gig within 2 weeks. The patch window is widest RIGHT NOW while IBB is paused and maintainers are overwhelmed. Narrows as projects find alternative funding or volunteers step in. > **🎣 The AI Report Farm (Grey Hat)** > > Look — everyone’s complaining about AI-generated bug reports. But here’s the thing nobody says out loud: _some of them are real_. The ratio is bad (maybe 1 in 20 is legit), but when you’re generating thousands of reports, that’s still a lot of real bugs. > > Here’s what you do: run AI scanners against private bounty programs (NOT the paused IBB). But — and this is the key — add a human verification layer before submitting. Use AI to find candidates, manually confirm they’re real, write proper reproduction steps, and submit only verified bugs. > > The programs that pay well ($5K-$50K per crit) on [Bugcrowd](https://www.bugcrowd.com/) and HackerOne private programs haven’t paused anything. They’ve just gotten pickier about report quality. If your AI-found, human-verified report is clean and reproducible, they pay the same as always. > > 🧠 _Example:_ A 21-year-old in Istanbul runs [CodeQL](https://codeql.github.com/) queries against 30 private program targets on Bugcrowd. AI flags 400 potential issues. He spends a weekend manually verifying the top 50. Finds 8 real bugs — 2 critical, 3 high, 3 medium. Submits clean reports with reproduction steps. Total payout: $23,000 over 6 weeks. > > > 📈 **Timeline:** Setup takes 2-3 days (install tools, pick targets). First batch of AI candidates in 24 hours. Manual verification is the bottleneck — budget 1-2 hours per candidate. First payout in 3-6 weeks (bounty review cycles). This play works as long as bounty programs exist, but competition increases as more people figure out the AI+human combo. > **🛠️ Follow-Up Actions** > > | Want To… | Do This | > | --- | --- | > | Check which bounties are still paying | Browse [HackerOne’s active programs](https://hackerone.com/directory/programs) — filter by “bounties offered” and sort by payout | > | See which open-source libs are now unprotected | Check the [IBB hacktivity page](https://hackerone.com/ibb/hacktivity) for disclosed-but-unpatched bugs | > | Map company dependencies | Use [deps.dev](https://deps.dev/) to see who uses which open-source package | > | Run your own AI code scanner | Start with [Semgrep](https://semgrep.dev/) (free tier) or [CodeQL](https://codeql.github.com/) (free for open-source) | > | Track maintainer complaints about AI spam | Follow the [cURL bug bounty drama](https://daniel.haxx.se/) on Daniel Stenberg’s blog — he documents everything | * * * **⚡ Quick Hits** | Want… | Do… | | --- | --- | | 💰 Quick bounty cash | Skip IBB entirely → target [Bugcrowd](https://www.bugcrowd.com/) and HackerOne private programs that still pay full price | | 🛡 Protect your own project | Add a `.github/SECURITY.md` with clear report guidelines to filter AI spam before it hits your inbox | | 🔍 Check if YOUR software uses affected libs | Run `npm audit` / `pip audit` / `cargo audit` on your project right now | | 🧠 Learn bug hunting from scratch | [PortSwigger Web Security Academy](https://portswigger.net/web-security) — still free, still the best starting point | | 📡 Stay updated on bounty changes | Follow [@Hacker0x01](https://twitter.com/Hacker0x01) and [@bugaborr](https://twitter.com/bugcrowd) on X for program updates | * * * _AI found all the bugs. Nobody’s paying to fix them. The internet runs on vibes and volunteer patches now._