{
  "id": 18621029,
  "title": "I asked 3 LLMs to triage bug bounty exploits. So I built a contract that runs them instead",
  "url": "https://urgent.news/2026/11/07/i-asked-3-llms-to-triage-bug-bounty-exploits-so-i-built-a-contract",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-07T02:41:14.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/edycutjong/i-asked-3-llms-to-triage-bug-bounty-exploits-so-i-built-a-contract-that-runs-them-instead-38i6"
  },
  "original_language": "en",
  "account": "A researcher built a contract that automatically runs AI-generated exploits for bug bounty programs, without human triage. The system measures the effectiveness of AI-written bug reports and pays out only if the AI successfully breaks the target. The contract uses a NEAR contract to hold the bounty pool in a secure environment, with no access keys. The contract verifies the integrity of the exploit and checks against a set of predefined conditions before paying out. The results show that AI-written exploits are prone to making false claims and failing to correctly identify real exploits. The contract prevents this by refusing to pay for invalid submissions, ensuring the bounty pool is protected and the ecosystem maintains trust.",
  "summary": "A bug bounty asks the hunter to go first. You hand over the bug, then a human triager decides whether it counts and how much it is worth. The protocol can patch it, call it \"known\" and pay nothing. And now a growing share of the reports in that queue are AI-written, confident and wrong. I wanted to see how bad the second problem is, so I measured it. Then I built a bounty where nobody triages at…",
  "key_points": [],
  "editors_take": "Automating the verification of AI-generated exploits through secure smart contracts protects bounty pools from the high rate of false claims and failed submissions produced by large language models.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}