Hundreds of crypto projects have run into a paradoxical threat: their security systems are drowning not in hacker attacks, but in mountains of digital garbage. Bug bounty programs, originally designed to uncover real vulnerabilities, are now being massively flooded with low-quality, neural-network-generated reports. The “AI slop” phenomenon does more than irritate triage teams — it creates critical risks by masking real exploits beneath thousands of false positives and devaluing the work of ethical hackers.
📊 Key fact: According to Immunefi, up to 70% of all submissions to vulnerability reward programs in 2025–2026 are automated AI spam. Auditors now spend days filtering through hundreds of fake reports before they can process a single real critical bug.
The term “slop” originally described low-quality AI-generated content on social media. In crypto security, it has taken on a destructive meaning. Attackers — or simply unethical “bug hunters” — use LLM-based scripts to massively scan open GitHub repositories.
Generative models are excellent at imitating the language of cybersecurity, but catastrophically bad at understanding the architecture of the Ethereum Virtual Machine (EVM). A typical AI slop report often claims a tx.origin or reentrancy vulnerability in functions already protected by nonReentrant modifiers or in functions that do not interact with external contracts at all. The AI “sees” a pattern from its training data — old reports about the The DAO hack — and mechanically projects it onto modern code while ignoring the context.
“Data is not information. Information is not knowledge. And AI spam is anti-knowledge disguised as truth,” — Clifford Stoll, writer and programmer.
The main problem is not that AI makes mistakes. The problem is the scale of those mistakes. When a triage team — specialists who review incoming reports — receives 500 submissions a day instead of 10, the system breaks down.
💡 Practical takeaway: Bug bounty is turning from a crowdsourced security tool into a DDoS attack against developers’ attention. Defending the perimeter no longer makes sense if the gateway itself is buried under garbage.
Paradoxically, the main victims of AI spam are not the projects, but legitimate researchers. In the past, a talented bug hunter could earn $50,000–$100,000 for finding a critical flaw. Today, because triage teams are overloaded, the response time for a valid report can stretch into months.
Platforms and projects are being forced to urgently change the rules of the game, introducing barriers that filter out bots without suffocating legitimate researchers.
“Security is not a product, but a process. But when the process drowns in noise, it stops being security and becomes bureaucracy,” — Bruce Schneier, cybersecurity expert.
The “click and submit” era in bug bounty is ending. To stand out, researchers now have to raise the standard of proof.
| Parameter | Before AI slop (2022) | In the AI slop era (2026) |
|---|---|---|
| PoC format | Text description + script | Video demonstration + interactive fork |
| Triage response time | 1–3 days | 2–4 weeks because of queues |
| Share of fakes | ~5% | ~70% |
In the 1990s, the internet was flooded with spam in Usenet and email. Users drowned in Viagra ads and Nigerian prince scams. It seemed that free communication was impossible. But the industry adapted: spam filters, DKIM signatures, and reputation systems emerged. The garbage did not disappear, but it stopped being the central problem and was pushed to the edges of the network.
Today, crypto bug bounty is going through its own “spam crisis of the 90s.” AI slop is not the end of ethical hacking — it is a painful stage of maturation. The industry is learning to separate signal from noise. The projects that manage to build reliable reputation and economic filters will not only protect their smart contracts, but will also create an elite circle of researchers whose word will be worth more than any algorithm.
In the crypto industry, code is law. But when the law is written with a random text generator, human intelligence steps back onto the stage. And in the end, it is human intelligence — not neural networks — that determines which protocols survive and which fall victim to their own automation.
“A machine can replace us in everything that is routine. But it will never replace us where understanding the essence is required. A vulnerability is not a syntax error — it is a logic error,” — Vitalik Buterin, co-founder of Ethereum.
