Bug Bounties Are Not Dead
Published on Aug 26, 2026
Over six and a half years, curl paid security researchers more than $100,000 for 87 confirmed vulnerabilities submitted through its bug bounty program. On January 31, 2026, curl founder Daniel Stenberg announced he was ending it because the explosion of slop from AI-generated reports became unbearable.
Every bug bounty program now faces the same problem. Producing a convincing report requires a single prompt, while verifying it can cost several security engineers anywhere from 30 minutes to 3 hours. AI broke the economics of manually validating every report and the industry is still struggling to adapt.
We sought to build a solution to help security teams deal with that shift: depthfirst validates each report against the threat model, codebase, and running application. It then gives security teams a deduplicated, corroborated, stack-ranked list of priorities, with suggested patches.
What reaches your queue
Incoming security reports are deduplicated, verified against the running application, and triaged into critical, high, medium, low, and other severity buckets with the full run log attached.
Vulnerability discovery is outpacing triage and validation
Historically, effort acted as the filter in vulnerability disclosure programs. Writing a report using the right terminology and a coherent attack story required deep domain knowledge, so a well-written report served as a reasonable proxy for an impactful finding. But with recent advancements in model security capabilities, that is no longer the case.
Over the course of 2025, curl’s confirmation rate fell from roughly 15% to under 5%. About 20% of submissions were obvious AI slop that maintainers could dismiss within a minute. But 5% were still valid. That left roughly 75% somewhere in between: wrong, but not obviously wrong. Those reports create the real cost. They require enough investigation to rule out, and they continue to multiply.
Matteo Collina, a Node.js core maintainer, recently described the experience of maintaining these programs: 20 to 40 reports a week, almost all AI-written, with 3 to 5 duplicates per issue. His triage process now includes explaining to an AI why something falls outside the threat model, then doing the same across all duplicate reports.
On the other side of the equation, Lyft security researcher Anshuman Bhartiya showed in a recent post how a single researcher with a good harness can outproduce an entire triage team through autonomous vulnerability research and reporting loops. While vulnerability discovery improved and accelerated with AI, triage and validation haven’t kept pace.
Imperfect reactions from defenders and bug bounty programs
Many programs have responded by using one or more of a few levers.
These approaches can reduce intake, but they do not reduce the cost of settling a claim. Someone still has to read the report, investigate the evidence, and decide whether the finding is real. Every lever simply adds friction to reduce inbound, but none help with verification.
Testing the claim, not the report
Security teams are already enlisting agents to help. Collina points an agent at each HackerOne report for analysis and pushes back on its conclusions until the evidence convinces him. That helps, but it still only evaluates the prose and reasons using static code, while the claim concerns a running application. As a result, a well-written report can survive that process even when incorrect because no one has tested whether the exploit works under the reported conditions. Security teams need to reproduce the reported vulnerability before making a decision.
So that is what we built: You can now forward any vulnerability report from your inbox to depthfirst, where it becomes the hypothesis for a targeted Agentic Pentesting run.
depthfirst already has the target, credentials, and application scope. It tests the claim against the running application and returns a verdict: exploitable vulnerability, false positive, or needs deeper validation. The verdict also includes the requests, responses, and full run log, so security teams can inspect what the agent tried and check its work instead of starting the investigation over.
Report on
Vulnerability report
Email sent to depthfirst!
Scan finished
successUnauthenticated Login SQL Injection Enables Administrator ...
High
Eighty-seven real vulnerabilities came through curl’s bug bounty program before Stenberg shut it down. While some reports were valuable, the cost of surfacing them became untenable.
Security teams now face the same tradeoff: add headcount, build and maintain their own validation system, or reduce the scope of their programs. We believe bug bounty and vulnerability disclosure programs are still very necessary, and reject the claims that proclaim them dead. It’s the validation model around them that has to change.
Bug Bounty Verification is now available in Private Preview for depthfirst customers. If you want to see it run against your own vulnerability reports, book a demo below.