Bug bounty programs are being buried in AI-written vulnerability reports, and Elastic has now published hard numbers on the scale of it.
In the first half of 2026, Elastic's HackerOne program received over 1,390 reports, which the company says is more than its full-year totals for 2024 and 2025 combined. Historically the program had taken 600 to 850 reports a year. Elastic attributes the jump to a large increase in the number of AI generated reports it receives, and describes the underlying economics bluntly: large language models made it trivially cheap to generate a vulnerability report, while the cost of properly reading one did not move at all.
Why triage is the bottleneck
A senior security engineer spends 30 to 60 minutes on a typical report, Elastic says: reading the submission, assessing validity against product-specific context, scoring severity, judging whether reproduction is feasible, and often spinning up an environment to verify the claim. The majority of that analyst time goes to reports that will ultimately be closed as informative or not applicable. That was already true before LLMs entered the picture. What changed is the volume, and with it the signal-to-noise ratio.
Agents against agents
Elastic's answer was to build an AI triage agent, and it has published the measured results rather than a claim. The system agrees with human security engineers 85% of the time, validated against 764 reports with known outcomes, with triage rules calibrated iteratively against a corpus of more than 3,300. A typical report costs roughly two dollars to triage. A human still makes the final call on every report, and only submissions that HackerOne's own AI triage marks for validation reach the pipeline at all, so Elastic is not paying to re-triage what HackerOne already filters.
The part worth copying
The architecture is the interesting part for anyone building something similar, because Elastic treated its own pipeline's input as hostile. Analysis and reproduction run on two separate ephemeral virtual machines. The analysis phase never executes code and never touches the reproduction environment; the reproduction phase, which runs steps described by an unknown researcher, gets a fresh throwaway machine with no persistent state, secrets injected as environment variables and held only in process memory, outbound traffic filtered through a proxy, and a 30-minute automatic shutdown regardless of state.
Elastic's stated reasoning is blast radius. If a reproduction attempt escapes the Docker sandbox, it lands on a machine with nothing useful on it that destroys itself within half an hour. Splitting the phases also lets the system skip reproduction entirely for obvious rejects, which Elastic puts at roughly 70% of reports rejected at the analysis stage.
The analysis itself is broken into eight stages rather than one judgment call, with a separate adversarial review that independently challenges the conclusions. Elastic singles out realistic exploitability as the stage that matters most, and frames it deliberately: not whether something could theoretically be exploited, but who the realistic attacker is, what access they already have, and whether the finding gives them anything they do not already possess. That is a reasonable test for any security team drowning in low-quality findings, with or without an agent doing the reading.
The full architecture, threat model and calibration detail are in Elastic Security Labs' write-up. It lands alongside a shift IntelFusions has tracked all year in what cheap AI does to both sides of the economics, from Check Point's argument that AI has crossed from hacking assistant to attack operator to fake exploit code aimed squarely at security researchers themselves.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.