What Happened to HackerOne? AI Slop and the Crisis of Bug Bounty Automation
The cybersecurity community is witnessing a profound crisis of trust in the bug bounty ecosystem, highlighted by a sharp decline in the reputation of HackerOne. Once celebrated as a mission-driven bridge between independent ethical hackers and security-conscious corporations, HackerOne is now criticized for prioritizing corporate sales, bureaucratic overhead, and automated triage at the expense of researcher integrity.
The core of this friction is the "AI slop" loop, which has flooded bug bounty programs with low-value, automated, and hallucinated reports. This influx of noise has forced platforms to adopt AI-driven triage systems, alienating human researchers who find themselves arguing with dismissive, automated bots. The resulting operational friction has led prominent organizations to restructure or entirely dismantle their public bug bounty programs.
The Circular Logic of AI Bug Hunting
The integration of LLMs into both sides of the vulnerability lifecycle has created a highly inefficient, circular process. Security researchers use models to generate massive volumes of plausible-sounding but technically shallow reports to see what sticks, while platforms deploy their own automated LLMs to filter the deluge.
This "turtles all the way down" approach to triage has rendered communication between researchers and programs increasingly hostile and robotic.
"An LLM finds a dubious bug, an LLM turns it into a convincing report, and now the proposed solution is to have an LLM triage it? There are a lot of turtles holding up this approach and the circular logic seems hard to miss. Automated triage can filter obvious spam, which was already fast and easy for humans to do. The hard part is independently reproducing a plausible finding and assessing its actual impact." — iepathos on Hacker News
"From what I've seen in the bounty-related subreddits, AI is flooding bug bounty inboxes with low-value or meaningless reports, or straight-up hallucinations when people use smaller models... curl shut down their bounty program, and GitHub just announced they're 'restructuring' theirs." — mapmeld on Hacker News
The Alienation of Human Expertise
As HackerOne and similar platforms optimize for volume and corporate metrics, human researchers report that their high-quality, manual findings are frequently downgraded or dismissed by automated systems. When researchers attempt to appeal these decisions, they are met with automated, "PR-approved" templates that offer no technical recourse.
This shift has accelerated maintainer burnout (as seen in Tech Retirement and the Existential Burnout of the AI Tipping Point) and is driving elite security talent away from public bounty platforms altogether.
"Imagine doing this article as a thorough writeup to provide feedback, rewriting this for like an hour before you post it. And then you get an AI slop response like that in return where you can't even tell whether it was just a CEO not giving a damn...or a standard dumb chat bot with a stupid response. I'm not sure if founders are aware that these are tipping points in customer care where the people that care about your product and ecosystem will leave your company for good..." — cookiengineer on Hacker News