AI Slop Halved Bug Bounty Payouts. Junior Researchers Get the Bill

GitHub cut every public bug bounty payout by at least 50% in July, and the payout tables are the least interesting part of the story. The interesting part is what a gated, two-tier bounty market does to the supply of human researchers that defenders quietly depend on.

The trigger is documented by now. HackerOne saw industry-wide report volume more than double in May 2026 after more capable AI tools shipped. Bugcrowd's triage queue grew 334% in one three-week stretch in March, almost entirely low-quality submissions their team started calling "sloptimism": reports sent fast and hopefully, the author trusting the model's output more than the evidence. Daniel Stenberg killed curl's paid bounty entirely in January. GitHub is the fourth major program to restructure, suspend, or narrow scope this year.

Triage hours are the real currency

Bugcrowd made the cleanest version of the argument: AI broke the economics of any human-validated system. Convincing content got cheap to generate. Checking whether that content is correct did not get cheaper at all.

Do the arithmetic on your own queue. A thousand extra reports a month at 20 minutes each to triage, reproduce, and close out is over 330 engineer-hours spent mostly proving negatives, before one valid finding gets paid. At that point a program reprices, gates access, or walks away. GitHub repriced and gated, after its May intake rules (working PoCs, demonstrated impact, pre-submission validation) failed to shrink the queue. curl walked.

The public tier absorbed the cut. Mediums dropped to $2,000 flat from a $5,000 ceiling. Meanwhile an invite-only VIP track pays three to four times the public rate to researchers with accepted findings already in the program: one critical, two highs, four mediums, or seven lows.

The missing middle

Here is my actual complaint. Mediums and lows are where researchers learn. They are the reports a talented 22-year-old writes while building the instinct and reputation that eventually produce criticals. Under the new structure that junior faces a signal gate, a four-submission cap, and half the old payout for the exact category of work that used to fund the learning curve. VIP status requires accepted findings, which is a reasonable bar for GitHub and a chicken-and-egg problem for anyone starting from zero.

Every program that gates newcomers behind signal requirements is optimizing its own queue while free-riding on a pipeline it is actively shrinking. Senior researchers are not born at the VIP tier. If the whole industry copies GitHub's gating without building an on-ramp, the senior researcher pool of 2029 gets thinner, and the bugs those people would have found get found by someone else or never found at all.

What I'd change before touching your payout table

Instrument intake first. Four numbers, weekly: not-actionable rate, duplicate rate, median hours to first response, valid findings per researcher cohort (new versus established). My thresholds, adjust to your volume: not-actionable above 50% for two consecutive weeks means tighten intake before payouts. First response slipping past 48 hours means you are paying reputational interest to the researchers you most want to keep.

Then gate on proof, not hope:

new_researcher:
  max_initial_submissions: 4
  requires:
    working_poc: true
    impact_statement: true
    affected_versions: true
  unlock_after:
    accepted_findings: 2
    min_severity: medium
triage:
  first_response_hours: 24
  auto_close_without_poc_days: 7

Cheaper than triage headcount, and fairer than silently deprioritizing new names.

Usable this week:

• Track not-actionable rate weekly and tighten intake requirements before you touch payout tables.
• Require a working PoC at intake; auto-close reports that never supply one.
• Honor in-flight reports at the rates in effect when they were submitted (GitHub got this part right).
• Keep one paid junior lane open, a scoped private program or CTF on-ramp, so newcomers can build track record. Self-interest dressed as generosity: those researchers report your criticals in three years instead of selling them.

If you run or rely on a bounty program, are you seeing the same volume shift, and would you gate new researchers or eat the triage cost?

Longer writeup with the full payout tables and the pushback section: https://axeploit.com/blog/ai-slop-cut-bug-bounty-payouts-in-half-the-talent-pipeline-gets-the-bill