AI is turning vulnerability discovery into a firehose
AI vulnerability detection is the use of machine learning and automated code analysis systems to scan software at scale for security flaws, generating vulnerability reports far faster than traditional manual testing or fuzzing methods and exposing a widening gap between finding weaknesses and fixing them in time to protect users. AI is no longer a clever assistant for security teams; it is a multiplier that has changed the pace of discovery. An automated system called NOVA read the source code of 3,915 open-source projects in two months and reported 14,090 vulnerabilities, each confirmed through its own validation pipeline. Only 8 percent of these matched bug types that traditional fuzzers handle, meaning 92 percent were issues such as broken permissions or access control that do not crash programs but still expose data and systems. This is excellent news for finding open source security flaws—but it is terrible news for the workflows meant to handle them.
When every bug is "in scope", nothing is
Corporations have quietly admitted that AI is reshaping their bug pipelines. One company paid more than USD 20 million (approx. RM92,000,000) in bug bounties to 562 researchers between July 1, 2025, and June 30, 2026, up from around USD 17 million (approx. RM78,200,000) to 344 researchers the previous year. It also expanded its program so that critical vulnerabilities affecting its online services are "In Scope By Default," even when the faulty code lives in third-party or open-source projects. That policy, combined with “the growing use of AI to support security research,” has helped drive an unprecedented surge in submissions and record-breaking patch cycles. According to that vendor, its increasingly crowded monthly patch releases are partly due to its own advanced AI models for vulnerability discovery. This is the paradox: opening the funnel and arming researchers with AI uncovers more real issues—but it also stretches triage and patching teams past breaking point.
Bug bounty programs are drowning in AI false positives
Bug bounty programs were designed for human-paced reporting, not AI-generated floods. Generative systems now make it trivial to mass-produce plausible-looking reports, and security teams are feeling it: one project’s confirmed-vulnerability rate on its bounty program fell below 5 percent, down from more than 15 percent before what its maintainers call the AI-slop wave. Another company responded to a surge of AI-generated claims by capping how many reports each researcher can have open at once, adding a 30-day cool-off period after the cap is hit. This is a defensive move, but also a warning: filtering AI false positives in security consumes far more human time than generating them. The core problem is that, even though some vendors also use AI to sift submissions, verification still demands careful reproduction, root-cause analysis, and impact assessment. AI has sped up the attackers and the reporters; it has not equally sped up the reviewers.
When a USD 200,000 exploit waits in the queue
The human bottleneck is not theoretical; it already costs real security wins. Security researchers at Bynario say a large platform’s new bug bounty policy held up their efforts to report dozens of vulnerabilities. Among them was a macOS privilege escalation exploit worth up to USD 200,000 (approx. RM920,000) on the black market. Last year, the same seven-person team reported eight exploits to this vendor; this year, with help from ChatGPT, they uncovered more than 50 in three weeks. But when they tried to report five of those, the platform’s quota system—introduced in response to a flood of AI-generated claims—blocked the disclosures. The lesson is brutal: policies built to defend staff from AI noise can delay the very high-impact bugs those programs are meant to surface. Machines are amplifying both quality and garbage; crude throttles treat both as the same.
Open source faces an AI-scale security problem
Nowhere is the gap between detection and response more dangerous than in open source. NOVA’s scan of 3,915 projects turned up 5,421 supply-chain findings; 1,280 were flaws in dependency packages, while 4,141 were downstream exposures where real applications reach a vulnerable dependency. Over half of these downstream exposures—2,776—were validated with a working proof of concept triggered from the downstream application itself, not just inferred from dependency graphs. “The gap between a patch and an exploit is the whole problem”. AI is collapsing that gap, because once a machine finds and validates an open source security flaw, attackers can move as fast as defenders. Meanwhile, ordinary users are stuck relying on automated patching tools that do nothing when updates fail or break their systems. Unless triage, patch distribution, and quality assurance catch up with AI discovery, we are replacing invisible bugs with visible chaos.
