AI’s Dual Impact on Bug Bounty Programs and Cybersecurity Learning

The growing use of artificial intelligence (AI) is having a mixed but significant impact on bug bounty programmes, initially leading to a dip in submission quality for some but ultimately playing a role in their improvement.

For individuals learning cybersecurity with an eye on bug hunting – discovering security flaws and getting paid for it – these shifts raise important questions about where to focus their efforts.

Early signs indicated challenges. In January 2026, curl, the widely used data transfer tool, ended its paid bounty programme after experiencing a notable decline in the quality of vulnerability submissions. Daniel Stenberg, the maintainer, noted that confirmed vulnerabilities dropped from over 15% in previous years to below 5% starting in 2025.

Submission Quality Recovers with AI

By April, however, Stenberg reported a recovery, with confirmed vulnerabilities returning to approximately 15-16%. He observed extensive AI use in these improved reports, indicating that while AI can generate volume, its effective application, combined with human verification, yields genuine findings.

This experience from curl, which had uncovered 87 confirmed vulnerabilities and paid researchers over $100,000, provides a clear lesson for learners: responsibility for the evidence behind a finding is paramount. Generating a report is easier than proving its claims.

Google’s broader vulnerability rewards programmes, which paid researchers $17.1 million in 2025, also faced pressures, with some specific areas like supply chain submissions experiencing pauses, though wider opportunities continue.

Building Foundational Cybersecurity Skills

Before pursuing bug bounties, aspiring security professionals should build a strong foundation in how systems operate. For web security, this means understanding HTTP requests, login sessions, permissions, and data handling. Basic networking and command-line skills are crucial for investigating unexpected results.

Practising in a dedicated learning environment allows for mistakes and repetition without impacting live services. Focusing on specific skills, such as explaining a request or identifying access controls, helps solidify understanding.

The learning process should involve documenting changes, outcomes, and reasons. The ability to explain and reproduce a result is a key measure of progress.

Leveraging AI as a Learning Aid

AI can be a valuable tool in the learning process, assisting with explaining unfamiliar errors, suggesting investigative questions, or reviewing the clarity of notes. However, its use is most effective when learners first attempt tasks independently and then use AI for specific points of confusion or hints.

For instance, after inspecting a lab request, asking AI to explain the relationship between a session cookie and a logged-in account can deepen understanding. If stuck, requesting a single hint after detailing previous attempts can guide the next step. The goal is to perform the task without assistance, demonstrating a full grasp of the evidence supporting a finding.

Reproducible Reporting is Key

Effective bug bounty reporting requires clear, reproducible steps. A finding of an access control flaw, for example, needs demonstrable evidence that one account can access another’s private information, violating intended permissions.

Reports should detail the affected asset, software version, exact reproduction steps (including account permissions), expected versus actual behaviour supported by evidence, and the demonstrated security impact, clearly identifying any assumptions. Checking that a peer or the reporter themselves can reproduce the issue from a fresh setup is a critical final step.

While bug bounty work is one application of security skills, the habit of verifying evidence is transferable to security operations, incident response, and penetration testing. Progress should be measured by skill development, not just bounty income. Documenting clear lab notes and write-ups can provide concrete work for career discussions.