Using AI to find authorization bugs — and to prove the ones that aren't real

Short summary

Bug bounty programs are suspending operations due to floods of low-quality AI-generated reports drowning triage teams. The author presents a two-stage methodology: fan-out screening with cheap models to surface authorization bugs, then adversarial verification with expensive models to refute false positives through precise source-line proof.

• •Bug bounty crisis: programs suspending due to AI-generated noise outpacing human triage capacity
• •Two-stage methodology: cheap fan-out for recall, expensive adversarial verification for precision
• •Core insight: correct negatives—refuting non-bugs with proof—are more valuable than finding candidates

Generated with AI, which can make mistakes.