From January to September 2026, the Standoff Bug Bounty platform received 18,400 vulnerability reports. This figure represents a 126% increase compared to the entire year of 2025 and exceeds the total volume of all previous years combined. Experts attribute this surge to researchers utilizing artificial intelligence tools to automate routine tasks.
Despite the doubling of total submissions, the number of verified vulnerabilities grew by only 48% year-on-year, reaching 4,700 cases compared to 3,200 in the first nine months of 2025. Notably, confirmed vulnerabilities classified as critical or high-risk increased by 68%, rising from 792 to 1,334 reports.
The integration of AI has lowered the barrier to entry for bug hunting, leading to an influx of low-quality reports generated by users lacking professional skills. This trend has impacted major technology companies, including Google and Intel, as well as the curl project, forcing them to pause payments under their bounty programs.
Platform operators are now facing challenges with a rising volume of invalid reports, particularly from new accounts. Experts warn that submitting intentionally false reports could be legally classified as fraud or abuse of platform trust, emphasizing that all findings still require manual verification in real-world conditions.
