AI-Generated Vulnerability Reports Overwhelm Bug Bounty Triage

Security teams and bug bounty programs are confronting a rise in AI-generated vulnerability submissions that appear technically credible but often cite nonexistent functions, commits, CVEs, attack paths, or impacts without reproducible evidence. The low cost of producing these reports shifts substantial verification work to expert triagers; curl, Node.js, and Hibernate have been cited as affected projects. HackerOne and Bugcrowd are responding with reputation, workflow, and machine-learning-based filtering, while valid AI-assisted discoveries still require concrete data-flow analysis and a working proof of concept, as demonstrated by CVE-2024-10099 and CVE-2024-10131.

Chrome's Security Team has published procedures for an anticipated influx of AI-generated reports in its internal processes and Vulnerability Rewards Program. It directs teams to fix S0 issues within one week and S1 issues within four weeks, initially handle reports lacking proof-of-concept code as security bugs, define security boundaries in SECURITY.md, and use invalid-report decisions as AI training and evaluation data. AI-generated findings receive the same disclosure treatment as human submissions, with publication 30 days after a fix, while the guidance also covers duplicates, disabled features, external dependencies, and rapid mitigations such as replacing renderer-reachable DCHECK assertions with CHECK assertions.