HackerOne’s $81M Bug-Bounty Bottleneck

HackerOne paid $81 million in rewards in the past year, up 13% year over year. Three months later, the curl project announced that it would end its HackerOne program because low-quality, AI-generated reports had overwhelmed the channel.

HackerOne’s payout measures the value of findings that survived review. Curl’s departure measures the cost of deciding which findings deserved to survive. Daniel Stenberg, curl’s founder, likened the submission load to a denial-of-service attack on maintainers: the inbox still functioned, but its openness had begun to defeat its purpose.

The report-volume model has reversed. As agentic security research collapses the cost of generating plausible vulnerability claims, trusted, reproducible evidence and adjudication capacity become scarce. Bug-bounty platforms are moving from marketplaces optimized for submissions into operational assurance systems that validate, route, prioritize, protect, and hand off findings for remediation.

Cheap discovery moves the attack surface into the inbox

A vulnerability claim does not arrive alone. A maintainer must identify the affected version, recreate the environment, test the proposed exploit, distinguish a new flaw from a duplicate, assess severity, find the responsible owner, and decide whether disclosure or remediation should come first. An AI system can generate another hypothesis without paying any of those downstream costs. The recipient pays them all.

The generator can turn plausible prose into reviewer work. A report can cite real functions, describe a credible failure mode, and include enough technical vocabulary to clear a superficial screen while still collapsing when a maintainer tries to reproduce it. The generator needs only one more attempt, while the maintainer has already spent scarce minutes.

Automated vulnerability research can also produce valid findings. Xbow’s autonomous penetration-testing tool topped HackerOne’s US leaderboard for reported security flaws, competing successfully inside the same incentive system that curl found unmanageable. Xbow complicates the easy story about human signal and machine noise because machines can produce both.

Maintainers need a testable case. An automated researcher that identifies an affected configuration, reproduces the behavior, and records the path to exploitation can reduce a defender’s work. A system that emits only a convincing possibility transfers its uncertainty to the recipient. Both may call their output a vulnerability report, although only one has completed enough work to justify the name.

The 20% commission was built for scarce reach

HackerOne’s 2015 pitch was straightforward: connect white-hat hackers with companies and collect a 20% commission on bounties. Companies could not employ every capable researcher, and researchers often lacked a legitimate route into companies. The platform supplied reach, rules, identity, payment, and a protected disclosure channel.

HackerOne answered the market’s original question: how could a company invite more outsiders to inspect its software without turning every unsolicited intrusion into a legal and operational crisis? Bugcrowd’s roughly 1,000 global customers later demonstrated how far the intermediary model could scale. A larger crowd gave companies more chances to catch the obscure mistake an internal team had missed.

The commission priced successful discovery while leaving companies to absorb failed review. A company paid a bounty after accepting a finding, but its maintainers spent attention before acceptance. While researchers bore meaningful costs to inspect code, develop an exploit, and write a report, those costs filtered many weak claims before they reached the platform. Cheap generation removed part of that upstream filter without removing any downstream obligation.

Program operators have responded by tightening background checks and building AI triage agents. Background checks ration who may enter the queue; triage agents ration which claims receive human attention. Wider access produced more rare findings when each participant faced meaningful research costs. It backfires when each participant can operate a tireless hypothesis generator.

A finder without a verifier only lengthens the queue

At the receiving end, defenders need a verifier that can reproduce results, test exploitability, compare findings with existing reports, estimate severity, identify ownership, and prepare a remediation handoff.

OpenAI positioned Codex Security across discovery, validation, and proposed fixes. Each stage removes a different uncertainty. Discovery asks whether a flaw might exist. Validation asks whether the claimed behavior survives contact with the software. Remediation asks whether a change can close the flaw without merely moving it.

Microsoft designed Project Perception to patch vulnerabilities, pairing action with its MAI-Cyber-1-Flash cybersecurity model. Trellix patched nearly 62,000 open-source projects affected by a flaw that exposed roughly 350,000 projects. That exposure required remediation at detection scale; a list of affected repositories would have left the code unchanged.

A bounded handoff gives security teams a place to inspect each transition. A discovery agent can provide the validator with the affected version and suspected path. A validator can return a reproduction trace and confidence assessment. An adjudicator can determine duplication, severity, and ownership before a remediation agent proposes a patch and test. Each agent produces an artifact that the next actor can challenge.

Security teams increasingly focus on governing agent execution. They need visible seams where another machine or a human can reject the work.

Trust tiers save reviewer time by spending openness

GitHub’s planned two-tier bounty program makes the trade explicit. GitHub plans lower rewards for public submissions and higher payouts for invite-only researchers, using access and compensation to steer effort toward people whose prior work makes their reports cheaper to assess.

Platforms were vetting researchers before the AI-report surge. ES&S partnered with Synack in 2020 to let Synack-vetted security professionals test some of its products. In 2023, HackerOne, Bugcrowd, Google, and Intel helped launch the Hacking Policy Council to advocate for laws protecting security researchers. Those companies already treated researcher legitimacy and lawful access as strategic infrastructure.

AI raises the price of getting the boundary wrong. A fully open program preserves the possibility that an unknown researcher will notice what every approved expert missed, but it also lets low-cost submissions consume review capacity. A closed program protects the queue, but it makes yesterday’s access a qualification for tomorrow’s access. The outsider who has never been invited cannot accumulate the reputation required for an invitation.

Background checks establish who submitted a report. A reproduction trace establishes whether the report is correct. Invitations reflect prior performance, while each new claim must still carry its own evidence. Program operators therefore need trust to attach to evidence trails as well as identities: a newcomer who repeatedly submits reproducible work should become easier to route, while an established researcher who sends unsupported claims should not inherit permanent priority.

GitHub’s public lane preserves an entry point while its invite-only lane reserves more money for trusted researchers. The two tiers turn openness from a default condition into a managed resource, preserving the crowd without assigning equal review priority to every knock.

Better evidence concentrates a more dangerous secret

Validators need richer proof. A reproducible report must reveal enough about the target, affected configuration, exploit path, and observed behavior for another actor to confirm the result. That evidence helps a defender because it reduces ambiguity. It helps an attacker for the same reason.

During Uber’s 2022 breach, an attacker accessed the company’s HackerOne program and downloaded vulnerability reports before losing access. In a separate incident that year, HackerOne said an employee stole submitted reports and disclosed them to seven companies for financial rewards. In 2026, the Klue breach affected HackerOne and other security vendors.

Those incidents reached valuable security information through three trust relationships: customer access at Uber, insider access at HackerOne, and the vendor ecosystem around Klue.

A platform that performs deeper validation has to retain enough evidence for reviewers and customers to reproduce its judgments, but every additional artifact increases the consequence of unauthorized access. The platform cannot treat exploit traces, affected versions, proposed fixes, and disclosure status as ordinary marketplace history. It has to compartmentalize them by customer, program, and workflow stage, giving each reviewer or agent only the evidence required for its bounded task.

The same handoffs that improve report quality can provide the security boundary. A discovery agent can work from target context, a validator from temporary access to the reproduction environment, and a remediation system from code context plus an approved finding. Traceability lets the next actor audit the result and records who touched the map before the weakness was repaired.

HackerOne’s payout economy reached $81 million even as curl moved to close its bounty door, because rewards count accepted findings while maintainers absorb the cost of rejecting the rest. The platform’s load-bearing wall has moved from the front door to the evidence room.