Bug bounty
Also called bug bounty programme, vulnerability rewards programme, VRP
A standing offer to pay outside researchers who find and privately report security flaws in an organisation's software.
A bug bounty pays strangers to tell you about your flaws before someone else uses them. The organisation publishes what may be tested and what it will pay; a researcher who finds a flaw reports it privately and is rewarded once it is confirmed.
The arrangement depends on reports being costly to write. Finding a real flaw takes skill and time, so most reports used to be worth a careful read.
AI removed that cost. A model writes a report that looks expert in moments, and the flaw it describes often doesn't exist. Sending one is free and a reward makes it worth a try, so the work of telling real from invented lands on whoever reads the inbox. Programmes are answering by asking for proof before anyone reads, by requiring reporters to say when AI was used, and in some cases by ending the payments.
For example
A researcher finds a way to read other customers' invoices on a shop's website, reports it through the shop's bounty page, and is paid once the shop confirms it.
Put it to use
Where you'll meet bug bounty in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.