TLDR AI made finding bugs cheap. It did nothing to make getting paid for them any easier. The same bug now gets found by ten different people inside a fortnight. One of them collects the money. The other nine collect a polite duplicate notice and a dent in their platform reputation. The programmes are drowning too. That is why curl shut down its entire bounty operation in January 2026, after fewer than one submission in twenty turned out to be real.