Why AI is the New Overachiever in Crypto Bug Bounties (And It’s Not All Good News)

by

It appears that our esteemed crypto teams are presently experiencing a most remarkable surge in bug bounty submissions, thanks to the rather industrious nature of those artificial intelligence contrivances, which have made it delightfully easier to comb through code and draft reports with commendable speed.

  • As the crypto community has observed, AI has not only increased the volume of bug bounty submissions but has also led to a regrettable rise in the number of false positives, much like an overly enthusiastic suitor who cannot discern the line between earnest affection and mere infatuation.
  • Indeed, Cosmos Labs has reported an astonishing 900% increase in submissions, compelling them to impose stricter review processes-like a mother determining which suitors are worthy of her daughter’s hand.
  • Developers, in their infinite wisdom, suggest that defensive AI might assist in filtering out the more insipid bug reports, thus allowing for the discovery of genuine threats-akin to a discerning eye revealing the true character behind a charming façade.

However, it must be noted with no small degree of irony that many protocols lament the burgeoning volume of submissions, which now include an abundance of low-quality or inaccurate findings, akin to finding a diamond among a heap of pebbles-rather tedious work, indeed!

Bug bounty programs, which generously reward security researchers for identifying software flaws before nefarious actors can exploit them, have become commonplace within the realm of crypto. This is particularly prudent as these protocols often manage considerable sums of user funds and operate on the principle of open-source code.

The Rise of Bug Bounty Submissions: A Tale of Two Reports

Mr. Barry Plunkett, co-CEO of Cosmos Labs, asserts that the advent of AI is transforming the landscape of bug bounty programs. He notes that his company’s program has experienced a rather staggering increase in submissions over the past year.

“Our program has seen a 900% increase in submission volume from last year, on the order of 20-50 per day,” exclaimed Mr. Plunkett with an air of astonishment.

He further lamented that this surge encompasses both valid and invalid reports, thereby complicating the arduous task of distinguishing genuine issues from rather feeble claims-a scenario reminiscent of sorting wheat from chaff.

Mr. Kadan Stadelmann, the chief technology officer at Komodo Platform, concurs, noting an uptick in both submissions and payouts across various organizations. He has observed that some of the recent reports possess questionable quality and may indeed be false positives-perhaps a consequence of AI’s penchant for embellishment.

”There has definitely been an increase in low-quality bug bounty submissions, some of which have been false positives, potentially suggesting AI sourcing,” Mr. Stadelmann remarked, with a hint of exasperation.

He further posited that the efficiency of AI may have inadvertently lowered the bar concerning the effort required to produce such reports, leading to an influx of submissions, much like an invitation to a ball that results in far too many dancers vying for the same partner.

AI: A Benevolent Ally or a Noisy Intruder?

Indeed, AI tools have proven themselves capable of assisting researchers in reviewing extensive quantities of code and swiftly identifying potential vulnerabilities. This has rendered it considerably easier for security researchers to engage with bounty programs and submit their findings to protocols.

Nevertheless, one must not overlook the fact that AI systems are also prone to generating misleading results. In the realm of bug bounties, this translates to teams receiving reports that may sound impressively technical yet lack any true substance-an unfortunate situation that undoubtedly burdens developers and security personnel with the daunting task of evaluating each claim.

This trend is not confined solely to the world of crypto; it has manifested beyond as well. In January, Mr. Daniel Stenberg, creator of the open-source tool curl, declared the termination of his bug bounty program due to what he termed an inundation of “AI slop in vulnerability reports.”

Moreover, HackerOne, a prominent bug bounty platform, reported an impressive tally of 85,000 valid bounty submissions in 2025, marking a 7% increase from the preceding year. One can only wonder if the increase in submissions correlates with the growing number of individuals seeking to make a name for themselves in this increasingly crowded field.

Platforms Tighten Their Standards: A Necessary Evil?

In light of the rising tide of submissions, certain crypto teams are compelled to reconsider the manner in which they conduct their bounty programs. Mr. Plunkett indicated that Cosmos Labs has tightened its scoring criteria for incoming reports, now favoring submissions from trusted researchers with a commendable track record.

Furthermore, the company is collaborating with bug bounty providers that offer more sophisticated triage support, an endeavor designed to alleviate the time spent reviewing mediocre or duplicate submissions-much like a judicious hostess streamlining her guest list.

These adjustments reflect an earnest attempt by teams to maintain the efficacy of bounty programs whilst deftly managing the additional burden imposed by AI-assisted reporting. While external researchers remain invaluable, there is a pressing need for more robust filters.

Security Teams Seeking AI for Defense: The Future Awaits

Mr. Stadelmann has postulated that AI may emerge as part of the solution. He observes that smaller teams are likely to bear the brunt of the strain, as they possess fewer engineers to evaluate the deluge of submissions.

”Blockchain teams will have to create AI deterrents to sift through incoming bug bounties,” he stated, with the gravitas of a sage.

He further suggested that the implementation of defensive AI systems could facilitate the sorting of reports, thereby lightening the load for internal teams. Indeed, as the tools of AI become more pervasive, bug bounty programs are expected to remain vibrant, albeit with the necessity for new processes to adeptly navigate the growing stream of submissions.

Read More

2026-04-22 11:13