The vulnerability market is entering a new phase
Artificial intelligence is not just changing how software is built. It is also changing how software breaks, how quickly those weaknesses are found, and what companies may have to pay to learn about them first. According to reporting in Wired, AI-driven vulnerability discovery is beginning to flood bug bounty programs, creating a new economic and operational strain across the software security ecosystem.
That matters because bug bounty programs became one of the most important bridges between independent security researchers and major technology companies. Instead of treating outside researchers as adversaries, companies increasingly paid them to disclose vulnerabilities responsibly. Now that system is being stress-tested by scale.
More bugs, more submissions, more pressure
The central shift is straightforward: agentic AI models are becoming more capable of autonomously identifying vulnerabilities and developing exploits. In practical terms, that means more weaknesses can be found faster, and by more people. The result, as described in the source text, is a surge in submissions to vulnerability disclosure and bounty programs at the same time organizations are finding more bugs internally as well.
Independent researcher Joseph Thacker told Wired that he had submitted roughly three times more bugs than at the same point the year before and speculated that a company like Google could end up spending two to 10 times more on payouts than last year. Whether that exact projection proves right, the direction of change is clear: the old relationship between researcher effort, bug scarcity and reward size is being disrupted.
Large technology companies may be able to absorb that pressure. Smaller organizations may not. If bounty programs are flooded with lower- and medium-severity findings that AI systems can uncover at scale, triage workloads rise, response teams are stretched and payout structures may need to change.
Attackers are moving at the same time defenders are
This is not only a story about more efficient defense. The same tools that help ethical researchers find vulnerabilities can help attackers develop exploits. That symmetry is one reason the shift is more serious than a temporary increase in submission volume.
The source text describes the field as changing in lockstep for attackers. If exploit development speeds up, the comfortable assumptions that once supported disclosure norms may erode. In particular, long-standing 90-day disclosure windows could come under pressure if companies believe attackers can weaponize flaws more quickly than before.
Security researcher Himanshu Anand, quoted in the article, argued that the 90-day responsible disclosure window was built for a world in which bug finders were rare and exploit development was slow. The claim captures the structural issue. Disclosure policy is based on the pace of discovery and exploitation. If AI changes both, the policy framework may no longer match reality.
The current abundance may not last forever
One of the more interesting points in the reporting is that today’s bounty surge may be transitional. Thacker suggested that researchers are currently harvesting accessible vulnerabilities, but that next year fewer bugs may be submitted because much of that easier ground will already have been covered. If that happens, companies could face a cycle in which payouts rise now, then may need to rise again later to attract attention to harder classes of flaws.
That would amount to a major shift in bug bounty economics. Instead of steady markets for scarce expert findings, organizations may confront waves of AI-amplified discovery: first abundance, then exhaustion of obvious targets, then competition for researchers who can push deeper.
Meanwhile, companies must decide whether their current security processes are fast enough for this environment. Triage queues, patch development, disclosure coordination and user communication all become more consequential when the time between vulnerability discovery and exploitability shrinks.
Security programs may need redesign, not just more budget
The likely lesson is that organizations cannot treat AI-enabled bug hunting as a simple cost increase. More money for payouts may help, but it will not solve the underlying workflow problem if intake, prioritization and remediation remain calibrated for a slower era.
Programs may need to adjust severity thresholds, automate parts of validation, rethink disclosure timelines and distinguish more sharply between high-value findings and commodity noise. None of those changes are easy, especially because bounty programs also carry reputational value: if researchers stop seeing them as efficient or fair, the best talent may redirect effort elsewhere.
- AI systems are making it easier to find software vulnerabilities and generate exploits.
- Bug bounty programs are being flooded with more findings, changing payout and triage economics.
- Large firms may be able to absorb the pressure more easily than smaller organizations.
- Faster exploit development could increase pressure on patch timelines and 90-day disclosure norms.
The broader point is simple. AI is accelerating both sides of the security contest. For software vendors, the question is no longer whether vulnerability discovery will speed up. It already has. The question now is whether the institutions built for a slower security economy can adapt before attackers exploit the gap.
This article is based on reporting by Wired. Read the original article.
Originally published on wired.com
