According to TechCrunch, Google paused its open-source bug bounty program due to a "significant rise" in AI-generated submissions, illustrating how automated noise can overwhelm triage workflows and security teams. Organizations running bounty programs must act to prevent backlogs and wasted effort.
Automation should cut obvious noise while preserving high-value reports; practices described by HackerOne show layered triage reduces analyst load and speeds handling of meaningful findings.
Key pitfalls are over-filtering that discards valid vulnerabilities and under-filtering that allows automated submissions to clog pipelines. Reports may also contain personal data; if a vulnerability leads to a personal data breach, under the EU GDPR organizations must notify the supervisory authority within 72 hours. Therefore filtering must be paired with legal and data-protection procedures.
Operational steps: 1) mandate PoC and structured reports, 2) automate pre-triage and duplicate detection, 3) use reporter scoring and intake limits, 4) tie processes into legal obligations (e.g., GDPR in the EU). These measures reduce the cost of AI-generated noise and protect security teams from being overwhelmed - an issue highlighted by TechCrunch and aligned with triage best practices from HackerOne.
Lub System helps B2B companies implement AI, automation and IT solutions end-to-end - from strategy to deployment. See our services or get in touch to discuss your case.