A bug bounty pays you per accepted report. Sit with that for a second, because everything else follows from it. You are not paid for making software safer — that’s unmeasurable and nobody tries to measure it. You are paid for producing artifacts a triager marks “valid.” The entire economy optimizes for the thing it can count, and the thing it can count is accepted reports, not reduced risk. Those two are supposed to move together. For a long time they mostly did. Then people noticed the gap and started living in it.
I don’t think bug bounties are a scam. They surfaced real vulnerabilities that would otherwise have rotted in production, and they routed money to researchers who deserved it. But the incentive was bent from the start, and the bend was invisible while volume was low and reports were mostly honest. Turn up the volume — which is exactly what the last two years did — and the bend becomes the whole shape of the thing.
What the model actually rewards
Start with severity. A payout table pays more for a critical than for a low. Rational, until you notice it’s the reporter who proposes the severity, and there’s no penalty for aiming high. So you get the padded submission: an information leak dressed up as remote code execution, a self-XSS narrated as account takeover, every dropdown in the severity form clicked to its most alarming option. The reporter isn’t necessarily lying. They’re responding correctly to a scoring function that rewards optimism and never punishes it. Triagers spend their day deflating severity, which is unpaid work the model quietly transferred onto them.
Then there’s the race. Most programs pay the first valid report of a bug and mark the rest as duplicates, usually for nothing. First-to-file sounds fair until you see what it selects for: speed over thoroughness. If being second means being unpaid, the correct move is to fire off a thin report the instant you smell something, before you’ve actually confirmed it, because a confirmed report that lands second is worth zero and a half-baked report that lands first is worth the bounty. The structure rewards submitting before you understand the bug. Maintainers then get four near-identical reports in a morning, three of which they have to read, adjudicate, and close as dupes — again, unpaid.
And then, at the bottom, the beg bounty. Spray automated scanner output at every program you can find — missing security headers, a SPF ~all softfail, a self-signed cert on a staging box — and demand payment for “findings” that are neither vulnerabilities nor news. It works often enough on unprepared companies to be worth doing at scale. It exists purely because the payout is the point and the security is incidental.
None of these require bad people. They require ordinary people responding to what the scoreboard rewards. That’s what a perverse incentive is: the system paying for a proxy of the thing it wants, until everyone optimizes the proxy and abandons the thing.
AI didn’t create the problem — it removed the friction
For years the perverse incentives were held in check by one accidental brake: writing a convincing bug report took effort. You had to read code, build a proof of concept, string together a plausible narrative. That cost filtered out most of the noise. It wasn’t a security control; it was friction, and friction was doing load-bearing work nobody had noticed.
Large language models removed the friction. You can now generate a fluent, technical-sounding, entirely fictional vulnerability report in seconds — complete with a CVSS score, a fake proof of concept, and confident references to functions that don’t exist. It reads exactly like a real report right up until an expert reads it closely. The cost of producing a plausible artifact fell to nearly zero, and the incentive to produce artifacts was always there. Predict the result.
The curl project is the case study, because Daniel Stenberg documented it in public with numbers instead of vibes. Over six years, curl’s bug bounty paid out roughly $86,000 and fixed 78 genuine vulnerabilities — a real program doing real work. For most of its life, north of 15% of submissions turned into confirmed bugs. Then in 2025 the confirmed rate collapsed below 5%: fewer than one in twenty submissions was real, and the rest was AI-generated slop that a human still had to read, because you can’t triage a security report by skimming it. In January 2026, after concluding that the flood was consuming maintainer time faster than it produced value, curl shut the program down and asked researchers to report through GitHub instead.
Read that carefully, because the naive lesson is “AI ruined bug bounties” and the real lesson is sharper. AI didn’t invent the incentive to spray low-value reports at a payout. That incentive was baked into “pay per accepted report” from day one. AI just made acting on it free. The slop was the perverse incentive finally running at full throttle with the brakes cut.
Who actually pays
Follow the cost. In the well-funded corporate case, a bug bounty is a triage team’s salary — expensive, but the company chose it and can absorb it. The people who get destroyed are open source maintainers, who are typically volunteers, and who bear the entire triage burden with none of the budget.
This is the part that should bother you if you use software, which you do. A security report cannot be ignored. Ignore the wrong one and you’re the maintainer who sat on a real vulnerability. So every report — including the confident, fluent, completely fabricated ones — demands a careful human read from someone who is not being paid and did not sign up to be a spam filter. The bounty model, plus zero-cost generation, turned “responsible disclosure” into an unpaid denial-of-service attack on the exact people holding up the software supply chain. Stenberg called it slop DDoSing open source, and the phrase is precise.
The grim irony is that the researchers doing honest, careful work are hurt worst of all. Their signal is now buried in an avalanche of fluent noise, their real reports wait longer in a deeper queue, and the maintainers they’re trying to help are burning out or closing programs — closing the door on the good reporters to keep out the bad ones. The incentive didn’t just fail to produce security. It’s actively degrading the disclosure channels that were working.
What actually aligns
If the problem is paying for a proxy, the fix is to stop rewarding the proxy and start charging for the noise.
The interventions that work all raise the cost of a bad report or lower its payoff. Reputation gates, where new accounts face stricter scrutiny and a history of slop costs you access, put friction back where AI removed it. Deposit or stake models, where a frivolous report costs the sender something, flip the economics of spraying. Paying for duplicates when they’re independently valid removes the perverse push to submit fast and thin. And narrowing scope — “we pay for exploitable vulnerabilities in these components, not for scanner output” — kills the beg bounty at the definition.
But the honest, uncomfortable answer is that some projects shouldn’t run a bounty at all. A bounty is a firehose of submissions pointed at your triage capacity, and if you’re three volunteers, that firehose is a weapon aimed at you. Plain coordinated disclosure — a security policy, a contact, no cash reward dangling as bait — produces less volume and a far better ratio, which for an understaffed project is the whole game. curl didn’t stop taking security reports. It stopped paying per report, and in doing so removed the incentive that the slop was feeding on.
The lesson isn’t that bug bounties are bad. It’s the same lesson as every metric that got gamed: the moment you pay for a number instead of the thing the number was standing in for, you should assume someone will eventually optimize the number straight into the ground. Bug bounties paid for accepted reports and hoped that meant security. For a while, with enough friction in the way, the hope held. The friction is gone now, and we get to find out what the incentive was really buying all along.