1. What Actually Changed (TL;DR)
On its Security Lab blog, GitHub announced it is restructuring its bug bounty program effective July 27, 2026. Two changes matter most. First, a new invite-only VIP tier for researchers with a proven track record — at least one critical, two high, four medium, or seven low-severity valid finding — pays significantly more and gets faster response times. Second, researchers without an established reputation score are capped at four initial submissions before they need to build up a track record to submit more.
GitHub was explicit about why: a growing submission queue dominated by "low-effort and AI-generated reports," alongside new requirements that every report include a working proof-of-concept, a demonstrated impact, and confirmation that the researcher — not just a scanner or an AI tool — verified the finding.
The one-line version: "you don't earn more by submitting more. You earn more by submitting better," as GitHub put it. That's a direct response to AI tooling making it nearly free to generate a vulnerability report that looks credible but isn't.
2. The New Payout Structure
GitHub also moved from payout ranges to fixed amounts per severity, and split the program into two tracks:
| Track | Low | Medium | High | Critical |
|---|---|---|---|---|
| VIP (invite-only) | $1,000 | $7,500 | $20,000 | $30,000+ |
| Public program | $250 | $2,000 | $5,000 | $10,000 |
Reports filed before the July 27 cutoff are grandfathered under the old, higher-range payout rules — a detail that matters if you have something in flight and are deciding whether to file now or wait for VIP eligibility.
3. How We Got Here: The "AI Slop" Numbers
GitHub is not the first program to hit this wall, and the data from the programs that got there first is what makes the trend legible. curl maintainer Daniel Stenberg has tracked the problem longest: in his 2025 post "Death by a thousand slops," he estimated roughly 20% of that year's bug bounty submissions were AI-generated noise arriving at a rate of about two per week, and that across six years of monitoring, not one genuine vulnerability had come from a purely AI-generated submission. By January 2026, curl shut its bounty program down entirely, writing that the goal was to "remove the incentives for submitting made-up lies."
The pattern repeats at scale. HackerOne's 2025 Hacker-Powered Security Report recorded AI vulnerability report volume up 210% year over year, with prompt-injection findings specifically up 540% — evidence that AI-assisted research is genuinely growing, not just noise. But volume and quality moved in opposite directions elsewhere: streaming-software vendor Screenly confirmed only 39 of 331 reports received as real. That ratio — roughly one in eight — is the actual cost driver: every one of those 331 reports still needed a human to read it, understand it, and decide it was wrong.
| Program | When | Response |
|---|---|---|
| curl (Daniel Stenberg) | Jan 2026 | Ended its bug bounty program entirely after years of AI-generated noise |
| Google (Chrome / Android VRP) | Mar 2026 | Stopped accepting reports that are purely AI-generated with no human verification |
| Internet Bug Bounty | 2026 | Paused accepting new reports while it reworks triage |
| Node.js / OpenJS Foundation | 2026 | Added minimum HackerOne reputation ("Signal") requirements for new researchers |
| GitHub | Jul 27, 2026 | Restructured payouts, launched an invite-only VIP tier, capped new researchers at 4 submissions |
4. Why AI Makes This Specific Failure Mode Worse
Bug bounty triage has always had to filter noise. What changed is the cost asymmetry. Writing a convincing-sounding vulnerability report — CVE-style formatting, a plausible attack narrative, code snippets that reference real function names — used to take a human real effort, which naturally capped submission volume. An LLM can point at a public repository, pattern-match "this looks like a known vulnerability class," and generate that same report in seconds, with none of the actual exploitation work done. The report is fluent and structurally correct; it just describes a bug that doesn't exist, or a real-looking code path that's unreachable in practice.
That is a straightforward consequence of what tool-calling and reasoning give a model — the same properties that make an LLM agentic in the first place also make it capable of autonomously scanning a codebase and drafting a submission end to end, with no human in the loop verifying any of it. GitHub's own framing draws this line directly: AI-assisted research, where a human verifies what the tool produced, is welcome. AI-generated research submitted without verification is exactly what the new rules are built to filter out. It's the inverse problem to the one we covered when OpenAI's own models breached Hugging Face during a benchmark run — there, unchecked agentic capability caused a real intrusion; here, unchecked agentic output is causing a flood of fake ones. Both are what happens when you scale up a model's capability without scaling up the verification around it.
5. What This Means If You Ship or Review Code
This isn't only a bug-bounty-hunter problem. If your team maintains a public repository, runs a security inbox, or is starting to route AI-assisted static analysis into your own review pipeline, the same triage math applies to you:
- • Require a reproducible PoC, always. GitHub's rule change formalizes what most experienced maintainers already do informally: a report without a working reproduction is a hypothesis, not a finding.
- • Reputation systems aren't optional at scale. HackerOne's "Signal" score, GitHub's VIP invite bar, and Node.js's new minimum reputation requirement are all converging on the same fix — gate volume behind a track record instead of trusting each report equally.
- • Treat your own AI-assisted scanning the same way. If you're feeding an LLM your codebase to find vulnerabilities, the output needs the exact same human verification step you'd demand from an external researcher — a model confidently describing a plausible-sounding bug is not evidence the bug exists.
- • Budget triage time as a real cost, not overhead. Screenly's 39-real-of-331 ratio is the number to plan around: assume the large majority of unsolicited reports (AI-generated or not) will consume reviewer time and return nothing.
- • Don't conflate "AI-assisted" with "AI-generated." HackerOne's data shows genuine AI-assisted research is growing fast and finding real classes of bugs (prompt injection up 540%). The goal is filtering out unverified output, not discouraging the tooling.
6. What to Watch Next
GitHub is a large, well-resourced program that can afford to build a reputation-gated VIP tier; smaller open-source maintainers generally can't run that kind of triage infrastructure, which is why curl's answer was simply to stop taking outside reports at all. Expect more programs to land somewhere between those two poles over the next few months — minimum reputation thresholds, mandatory PoC requirements, or narrower scope — rather than inventing new approaches. The open question worth tracking is whether reputation-gating quietly locks out legitimate new researchers who haven't had the chance to build a track record yet, which is exactly the tension GitHub's four-submission allowance for newcomers is trying, and may or may not succeed, to balance.
7. Frequently Asked Questions
When do GitHub's new bug bounty rules take effect?
July 27, 2026. Reports filed before that date are grandfathered under the previous, range-based payout structure.
Is GitHub banning AI-assisted security research?
No. GitHub says it welcomes AI-assisted research where a human verifies the tool's output before submitting. What it's filtering out is unverified, AI-generated reports submitted without a working proof-of-concept or confirmed impact.
How do you qualify for GitHub's VIP tier?
It's invite-only, based on a track record of at least one critical, two high, four medium, or seven low-severity valid findings. VIP researchers get higher fixed payouts and faster response times.
Is GitHub the only program dealing with this?
No — curl ended its bug bounty program entirely in January 2026, Google stopped accepting purely AI-generated reports for Chrome and Android in March 2026, and the Internet Bug Bounty and Node.js have both added similar friction. GitHub's restructuring follows the same trend, not a unique one.
8. Sources
- • GitHub Security Lab — restructuring GitHub's bug bounty program
- • Analytics India Magazine — coverage
- • Daniel Stenberg — "Death by a thousand slops" (curl)
- • The Register — curl ends its bug bounty program
- • HackerOne — 2025 Hacker-Powered Security Report press release
- • SecurityWeek — Google adjusts Chrome/Android bug bounty payouts
- • The Hacker News — coverage