I asked 3 LLMs to triage bug bounty exploits. So I built a contract that runs them instead
A bug bounty asks the hunter to go first. You hand over the bug, then a human triager decides whether it counts and how much it is worth. The protocol can patch it, call it "known" and pay nothing. And now a growing share of the reports in that queue are AI-written, confident and wrong. I wanted to see how bad the second problem is, so I measured it. Then I built a bounty where nobody triages at…
A researcher built a contract that automatically runs AI-generated exploits for bug bounty programs, without human triage. The system measures the effectiveness of AI-written bug reports and pays out only if the AI successfully breaks the target. The contract uses a NEAR contract to hold the bounty pool in a secure environment, with no access keys.
The contract verifies the integrity of the exploit and checks against a set of predefined conditions before paying out. The results show that AI-written exploits are prone to making false claims and failing to correctly identify real exploits. The contract prevents this by refusing to pay for invalid submissions, ensuring the bounty pool is protected and the ecosystem maintains trust.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
