AI Script Kiddies Broke Bug Bounty Hunting

⚠️ tl;dr — RIP Bug Bounty Hunting in 2026

https://www.danilchenko.dev/posts/ai-bug-bounty-crisis/

Hola Friends,

Welp! It's finally happened. The tech bros unleashed onto the world tools that were supposed to streamline workflows, make coders out of the non-technical folks, and if you are a luddite, bring about the destruction of humanity … yay!

But where my focus is in this post, is the abject discombobulation (what a fun word) of the bug bounty hunting programs en masse. And as someone new to the discipline, I am saddened and frustrated, but not surprised by the turn of events. I hate to say it, but bug bounty hunting is dead, or at least on life support. Here's why:

Lack of Self-Reliance

It might be a Gen-X hot take on my part, but I have seen so many newb hunters lately go on the social media sites looking for "road maps," "guidance," and "mentors" to basically teach them the skill and methodology of bug bounty hunting without putting in the work to actually research the information, do the homework, practice in the labs, and develop a plan. Instead, they'll go on reddit and post about wanting help with as little effort as a possible in looking for the information themselves. And in an age where the information is readily available, be it on the web or through a chatbot, the laziness kills me.

What AI has done (and no, I will not call it super intelligence .. that's a rant for another day) is taken away agency and allowed a few newbs … scriptKiddie2.0 to outsource the thinking to the bot. They'll simply enter a few prompts, paste the URL, and et voila! an instant pen test, complete with report, POC, and whatever else they would need. Which brings me to my next point.

Lack of Quality Reporting

The recent tech crunch article — https://techcrunch.com/2026/10/04/google-froze-its-open-source-bug-bounty-program-due-to-a-significant-rise-in-ai-submissions/ should be a signal flare to all that AI slop has gotten out of hand.

Bugcrowd is a platform I have been using for the last few months, and since the summer, I can attest to the fact that things have gotten really bad. So much so, they've had to make changes to their platform, as indicated in this article: https://www.bugcrowd.com/blog/bugcrowd-policy-changes-to-address-ai-slop-submissions/

A majority of newbs (scriptKiddie2.0 )will run to reddit when their reports are marked duplicate or not applicable, never mentioning the poor quality of their report, lack of demonstrable impact, or reproducible steps. And even when a report is somewhat viable, it will get flagged as "AI slop" and closed accordingly. The triage process is being overwhelmed with a higher than normal volume of subpar reports thanks to the bots and the users running them. Tools like Anthropic's MYTHOS have turned an uneducated newb with a desire to hack into a nuisance and I'm calling them:scriptKiddie2.0.

Lack of Respect For the Craft

The AI agent is as useful as a bricklayer. Given the right set of instructions, they can perform amazingly in half the time. Or, when put in the wrong hands, they can run wild and commit all manner of felonies against a system.

The newbs all want to be "Mr. Robot," without learning the craft. The lesson I had to learn the hard way is that security testing is less about doing the cool sh** that brings down a system, and more about doing just enough to show that you could, if you were a bad guy, but stopping just at the line between a P1 find and violation of scope and possible crime.

How I've seen it happen, a majority of the newbs will turn to AI and let the bot do the driving. No regard for safety. No care given to learning the tools. No discipline in being mindful of scope. They just paste the URL, turn the agent loose, and pray for a P1 or P2 that they can report to the program for a payout.

But to be honest, I can't lay the blame squarely on the newb hunters. The platform triage agents are just as much to blame for the decline of the bug bounty hunting process.

Lack of Human Interaction

I'm almost a year into bug bounty hunting, and boy how things have changed dramatically.

In 2025, when I started, I was participating in the unpaid Vulnerability Disclosure Programs (VDPs) to get a sense of how things worked. I remember fighting with a triage agent regarding a report I was sure was a legitimate finding. It was a lot of back-and-forth, with no real winning, despite all evidence to support my case. I left that platform and moved to Bugcrowd, where the triage was a bit better .. but not by much.

As of August of this year, I have seen a dramatic decline in the triage process. Whether it is because they have incorporated AI into quicker resolutions or staffing shortages, the time to resolution has become much longer. Most annoying of all, a triage "bot" will auto-reject your report before it has made it up to a human. The amount of INFORMATIONAL reports that have been sent back to me have given me pause.

Lack of Support

The request for a review process has lengthened from a few weeks to almost never. I had one RaR run so long, the window of time expired granting me the opportunity to retry. I didn't bother. I've seen several complaints about payments being delayed for months at a time. Ouch!!

Filing a support ticket is taking a hit as well. For every one report that gets filed and rejected, there are several tickets in the support system queue that will simply go for months without getting resolved. Unclear if it is a matter of volume, or lack of response from a Product Owner, but the experience has degraded substantially.

Conclusion