AI-driven bug discovery is overwhelming software vendors' disclosure pipelines, researchers say
Finding vulnerabilities is getting cheap while fixing and reporting them is not, which makes remediation and disclosure process the skills worth building.
Bug bounty platforms and veteran vulnerability researchers told Dark Reading on 4 September that large language models have sharply increased the volume of vulnerability reports, and that software vendors are struggling to keep up. HackerOne reported that submissions doubled year over year, and Bugcrowd and Trend's Zero Day Initiative described similar spikes. Platforms have responded by deploying AI-based triage to handle the intake.
HackerOne chief executive Kara Sprague said the number of critical vulnerabilities sitting in customer backlogs had grown thirty-fold over the past twelve months, even as mean time to remediation improved by about half. Katie Moussouris, founder of Luta Security, said she is seeing well-resourced security teams trim their bounty programmes and add qualification gates to slow the flow of reports, and argued that bounties should catch what a vendor missed rather than serve as the primary discovery method.
Disclosure is a second bottleneck. Casey Ellis, president of Disclose.io and a founder of Bugcrowd, said many researchers using AI tools are holding large numbers of findings because they cannot find a responsive channel at the vendor and do not want to publish them and create user risk. He noted that many organisations still lack a vulnerability disclosure policy or legal safe harbour, and some treat good-faith research as criminal activity.
Aaron Portnoy of Mindgard, a founder of the Pwn2Own competition, said the change removes the cover that vendors once had for shipping insecure code, because automated discovery runs continuously and at scale. Bugcrowd chief executive Dave Gerry said the industry was not prepared to fix everything found when he started in 2012 and remains unprepared today. The article frames the situation as a reckoning for secure-by-design practices rather than a problem that bounty programmes alone can solve.
Why it matters
Vulnerability discovery, once limited by human attention, is becoming an automated pipeline, which shifts the scarce resource to fixing and coordinating. Vendors that lack a disclosure policy, a triage process and a remediation budget will accumulate known but unfixed flaws at a rate their attackers can exploit. The economics of bounty programmes are moving from rewarding rare, severe findings to managing volume. Over time this pressure is likely to favour secure defaults, memory-safe languages and automated patching over reactive bug hunting.
Vulnerability discovery, once limited by human attention, is becoming an automated pipeline, which shifts the scarce resource to fixing and coordinating.
Discovery
LLM-assisted researchers find flaws continuously; platforms report submissions doubling year over year
Reporting
Researchers need a channel and safe harbour; without one, findings sit unreported
Triage
Platforms use AI classifiers to reproduce, deduplicate and score the flood of reports
Remediation
Vendors fix on engineering timelines; critical backlogs reported up thirty-fold in 12 months
Disclosure
Coordinated publication once a fix ships, or a stalemate when the vendor never responds
What you can learn from this
Coordinated vulnerability disclosure is a defined process with roles and timelines. A researcher reports a flaw privately to the vendor, the vendor confirms and fixes it, and both agree on a date for public disclosure, commonly around 90 days after the report. The process works only when the vendor publishes a way to reach it, such as a security.txt file and a policy page. Without a channel, well-meaning researchers face a choice between silence and public release, which is the stalemate the article describes.
Triage is the step that converts a report into an engineering task. Triage checks whether a submission is reproducible, whether it duplicates a known issue, how severe it is under a scheme such as CVSS, and which team owns the affected code. Automated discovery floods this step with low-quality or duplicate reports alongside real ones, so platforms apply AI classifiers to sort the queue. Notice that severity scoring and deduplication are precisely the parts a model can accelerate, while the fix still needs a human with context.
Secure by design means preventing bug classes, not patching instances. Choosing a memory-safe language, validating input at trust boundaries and using parameterised queries removes whole categories of vulnerability before they are written. A backlog growing thirty-fold suggests that many products are still generating the same classes of flaw repeatedly. The lesson is that the cheapest fix is architectural and applied once, rather than a patch per report. Fewer bug classes also means fewer reports to triage, which is the only way the intake numbers come down.
Safe harbour language is what makes research legally possible. Computer misuse laws in many countries prohibit unauthorised access regardless of intent, so a researcher who probes a live system can be exposed to prosecution. A published disclosure policy that authorises good-faith testing within defined limits removes that risk, and standards bodies recommend it for that reason. Organisations that omit it effectively ask researchers to trust them personally, which does not scale to thousands of automated findings.
Bounty economics reward whatever is scarce. When discovery was expensive, platforms paid large sums for a few critical bugs; when discovery is cheap, value shifts to verified, deduplicated, well-written reports and to fixes. Programmes adding qualification tiers to manage intake change how newcomers gain access. Understanding this helps a learner decide whether to build skills in exploitation, in triage tooling or in remediation engineering. The skills in demand shift with the bottleneck.
We teach this
How to use this in practice
Publish or check a security.txt file. For any site or project you run, create
/.well-known/security.txtwith a contact address, a preferred language and an expiry date following RFC 9116, then fetch it with curl to confirm it serves correctly. Done is a file that passes the securitytxt.org checker and points at an inbox that someone actually reads. Set a calendar reminder to refresh the expiry date before it lapses, since an expired file is treated as absent.Write a one-page vulnerability disclosure policy for a personal project. Include which systems are in scope, what testing is prohibited, how long you will take to acknowledge a report, and a sentence authorising good-faith research within those limits. Done is a SECURITY.md file at the root of the repository that GitHub surfaces on the security tab. Keep it to a single page; a policy nobody reads is no better than none, and link it from the README.
Run one static analysis tool and triage its output like a report queue. Install Semgrep or CodeQL on a codebase you know, run the default rule set, and sort the findings into confirmed, duplicate, false positive and won't fix, recording the reason for each decision. Done is a triage log where every finding has a category, and the confirmed ones have an issue opened with a severity score attached. Time yourself, because that number is your personal triage rate and the one that platforms are now automating.
Measure your own time to remediate. Pick the three most severe confirmed findings from that run, fix them, and record the calendar time from discovery to merged fix. Done is a number you can compare against the next run, which is the same metric platforms track as mean time to remediation and the one that reportedly improved by half even as backlogs grew. If a fix takes longer than a week, write down what blocked it, since that is usually process rather than code.
Sources
Our reporting is an original summary; full coverage is at the links above.
Don't just read about it — build it.
Square 1 teaches the skills behind the headlines, with every line of your work graded by AI. Find your starting point in 3 minutes.
Get your free skill report