AI systems are no moving beyond explaining vulnerabilities and generating security code. New models are beginning to discover previously unknown software flaws at a scale that could change how bug bounty hunters, security researchers and software developers find and fix vulnerabilities.
For decades, finding a serious software vulnerability has required a combination of programming knowledge, security expertise, patience and a lot of experimentation. A researcher might spend weeks studying a codebase before discovering one overlooked flaw.
That equation is beginning to change.
In 2026, increasingly capable AI models are being used to search through software, identify unusual behaviour and uncover vulnerabilities that traditional security tools and years of testing may have missed. Anthropic says Claude Mythos Preview has found thousands of high- and critical-severity vulnerabilities, including flaws across widely used open-source software.
The surprising part is not simply that AI can find bugs.
It is how quickly the technology is improving and what that could mean for the humans who have traditionally made vulnerability research their profession.
AI Is Moving From Finding Code to Finding What Is Wrong With It
Security tools have been helping researchers find software weaknesses for years. Fuzzers, scanners and static-analysis tools can examine enormous amounts of code and test applications for suspicious behaviour.
But many vulnerabilities are not obvious.
A program may work normally in almost every situation while failing because of one unusual combination of inputs. Finding that kind of problem can require understanding how different parts of the software interact rather than simply looking for a known pattern.
This is where modern AI models are becoming particularly interesting.
Anthropic’s testing found that Claude Mythos Preview could discover complex vulnerabilities, reproduce them and, in some cases, develop exploit chains from the weaknesses it identified. Anthropic described this as a significant step beyond simply generating security-related code.
That gives AI a different role.
It is not simply becoming another security scanner.
It is beginning to behave more like a security researcher.
Claude Has Already Found Thousands of Vulnerabilities
The scale of Anthropic’s experiments makes the development difficult to ignore.
In April 2026, Anthropic launched Project Glasswing, giving selected organisations access to Claude Mythos Preview to help search critical software for vulnerabilities. By May, Anthropic said the model and roughly 50 partners had found more than 10,000 high- or critical-severity vulnerabilities.
Anthropic’s separate open-source disclosure programme provides a more detailed picture.
By May 22, Mythos Preview had generated 23,019 candidate vulnerability findings across the projects it scanned. Of the 1,900 candidates that went through the relevant review stage, 90.8% were confirmed as true positives. Anthropic had disclosed 1,596 vulnerabilities across 281 open-source projects, with 97 known to have been patched at that time.
But there is an important distinction.
These numbers do not mean that AI automatically discovered 23,019 confirmed vulnerabilities.
Human security researchers and external security firms were still needed to reproduce findings, determine whether they were real, assess their severity and prepare responsible disclosures. Anthropic explicitly says that human triage and review had become the rate-limiting step.
That creates a much bigger story:
AI may be making vulnerability discovery faster than humans can verify, disclose and fix the results.
What Happens When AI Starts Doing the Work of a Bug Bounty Hunter?
For a long time, bug bounty hunting was a distinctly human process.
A researcher would choose a target, study how it worked, search for weaknesses, build a proof of concept and submit the finding to a company in exchange for a reward.
AI is beginning to change that workflow.
A researcher can use an AI coding agent to examine a large codebase, trace how information moves through different components and investigate suspicious behaviour. Instead of manually exploring every possibility, the researcher can use AI to investigate many potential paths and then concentrate on the findings that appear most promising.
The important distinction is that AI does not necessarily have to replace the researcher.
It can become a force multiplier.
A human researcher who previously investigated ten promising areas might use AI to examine hundreds of possibilities and then spend their own time validating the strongest findings.
That could fundamentally change the economics of bug hunting.
The Money Behind Bug Hunting
This is where the story becomes especially interesting.
Finding a vulnerability can be financially valuable because companies may pay researchers to report security weaknesses before criminals discover and exploit them.
Microsoft, for example, reported paying more than $20 million to 562 security researchers across 64 countries during its latest bounty period. Individual Microsoft bounty programmes can offer rewards reaching $250,000 for certain high-impact vulnerabilities.
Microsoft’s 2026 Zero Day Quest also produced more than $2.3 million in rewards from security research submitted during the event.
But there is an important point for this article:
That money was paid to human security researchers not to Claude.
AI is currently changing how researchers find vulnerabilities, rather than becoming an independent bug-bounty hunter collecting rewards itself.
That distinction matters because it points toward a different future.
The valuable skill may gradually move away from simply finding a possible bug and toward proving that the bug matters.
The Valuable Skill May No Longer Be Finding the First Bug
If an AI can examine thousands of lines of code and generate potential vulnerabilities rapidly, simply identifying suspicious code may become less valuable.
The difficult questions become:
Is the vulnerability real?
Can it actually be reproduced?
What systems are affected?
How serious is the impact?
Can the result be independently verified?
How should the developer fix it?
These are areas where human judgement remains extremely important.
Anthropic’s own disclosure process demonstrates this. The model generated thousands of candidates, but human researchers were still needed to validate and triage them before responsible disclosure.
Anthropic has also acknowledged that Mythos Preview’s ability to develop exploits is a major part of its capability, making careful deployment important as these systems become more widely available.
So the future of vulnerability research may not be:
Human finds bug → AI replaces human.
It may instead become:
AI searches → human investigates → AI assists → human validates → company fixes.
That is a very different kind of cybersecurity workflow.
Bug Bounty Platforms Are Already Seeing the Downside
There is another side to the AI revolution.
If AI makes it dramatically easier to generate vulnerability reports, companies can receive far more submissions including reports that are incomplete, duplicated or simply wrong.
Bugcrowd said that in March 2026 its triage queue grew by 334% over a three week period, driven largely by low-quality submissions with weak evidence, templated reports and little validation. The company described this behaviour as “sloptimism” relying on an AI-generated claim without properly verifying whether the underlying vulnerability is real.
Bugcrowd subsequently introduced measures including submission throttling, CAPTCHA validation, identity verification and penalties for accounts submitting large numbers of invalid reports.
This creates a strange new problem for the security industry.
Before AI, one major challenge was:
How do we find enough vulnerabilities?
With AI-assisted research, another question is becoming just as important:
How do we separate valuable vulnerabilities from a flood of machine-generated noise?
The best researcher may not be the person who can generate the most reports.
It may be the person who knows which one is worth reporting.
AI Won’t Kill Bug Bounty Hunting: It Will Change What Makes a Good Hunter
The rise of AI does not necessarily mean the end of human bug bounty hunters.
In fact, the opposite may happen.
As AI becomes better at searching code and generating potential vulnerabilities, human researchers may become more valuable for the parts of security research that require judgement, creativity and verification.
A researcher who knows how to direct an AI agent, investigate its findings, reproduce a vulnerability and demonstrate its real-world impact could have a significant advantage over someone working entirely manually.
The role is changing from finding every possible bug to finding the bugs that actually matter.
Anthropic’s own experience with Mythos illustrates this shift. Its system generated 23,019 candidate findings, but only 1,900 went through the relevant review stage, where external security firms confirmed a 90.8% true-positive rate. The gap between discovery and verification shows why human expertise remains important.
Human + AI Could Become the New Bug-Hunting Team
The most realistic future may not be humans competing directly against AI.
It may be humans working with AI.
An experienced researcher could use AI to explore a large codebase, identify suspicious functions and suggest possible attack paths. The researcher could then investigate the strongest candidates, reproduce the issue and determine whether it deserves disclosure.
This creates a new workflow:
AI searches → human investigates → AI assists → human validates → developer fixes
That could allow individual researchers to investigate much larger targets than they could previously handle alone.
And there is already evidence that AI-assisted vulnerability discovery is moving beyond one company’s experiments. A July 2026 research project called Antiproof combined automated vulnerability detection with proof-of-exploitability checks. In tests, it detected 64 of 66 vulnerabilities in its benchmark and reported several hundred previously unknown vulnerabilities during a scan of 50 widely deployed systems. The researchers said 12 CVE assignments had been received at the time of publication.
The direction is becoming clear:
AI is not just being taught to find suspicious code. It is being developed to determine whether a suspected flaw can actually produce a meaningful security impact.
But AI Is Also Becoming Competition
There is another possibility that is harder for bug bounty hunters to ignore.
If everyone has access to increasingly capable AI security tools, the barrier to entering vulnerability research could fall dramatically.
A beginner may be able to ask an AI system to examine a project that previously required years of experience to understand.
At the same time, experienced researchers can use the same technology to work faster.
That creates a new competitive environment.
The advantage may shift toward researchers who understand how to ask better questions, recognise unusual behaviour, validate findings and understand the underlying technology.
In other words, AI could make basic vulnerability discovery easier while making deep security expertise even more valuable.
AI Is Creating a New Arms Race
The most important question is not whether AI will help defenders.
It already can.
The bigger question is what happens when the same capabilities become available to attackers.
Anthropic has said Mythos Preview can find complex vulnerabilities and turn some of them into exploit primitives and complete attack chains. That capability was one reason the company chose to restrict the model through Project Glasswing rather than release it broadly.
The competition could therefore become:
AI searching for vulnerabilities
versus
AI searching for vulnerabilities first.
That changes the traditional security race.
Previously, defenders could spend months discovering and patching weaknesses while attackers searched for the same flaws. If AI dramatically reduces the time required to find and exploit vulnerabilities, the gap between discovery and exploitation could become much smaller.
And that makes patching speed increasingly important.
The Next Generation of Bug Hunters May Look Different
The bug bounty hunter of the future may spend less time manually searching thousands of lines of code.
Instead, their day could involve managing several AI agents, comparing their findings, testing unusual hypotheses, creating proof-of-concept demonstrations and deciding which vulnerabilities deserve a responsible disclosure.
That does not make cybersecurity less human.
It changes where the human adds value.
The strongest researchers may become the people who understand both sides:
how AI thinks about software and how real systems actually fail.
This could also create opportunities for developers and security professionals who learn to use AI responsibly rather than treating it as either a threat or a replacement for expertise.
What Companies Need to Prepare For
The change is not only affecting researchers.
Software companies also need to prepare for a world where vulnerabilities can be discovered much faster.
Traditional security processes were designed around a relatively manageable number of reports. AI could dramatically increase the number of findings that reach security teams.
Anthropic has already described human triage and review as the limiting step in its Mythos vulnerability-disclosure process.
Apple has also reportedly introduced limits around security-report submissions after experiencing a surge in AI-generated reports, including large numbers of low-quality or unverified claims. At the same time, researchers have continued finding legitimate vulnerabilities with AI-assisted techniques.
That means companies will need better systems for:
- validating vulnerability reports
- prioritising serious findings
- automatically reproducing issues
- connecting reports to affected code
- producing patches faster
- distinguishing useful research from AI-generated noise
The security problem is therefore changing from “How do we find bugs?” to “How do we process and fix them quickly enough?”
The Real Future May Be AI vs. AI
The most dramatic possibility is that cybersecurity eventually becomes a competition between automated systems.
One AI searches for vulnerabilities.
Another AI monitors the software.
A third system attempts to reproduce the attack.
Another automatically creates a patch.
Humans then supervise the systems, investigate the most important findings and make decisions where automated tools cannot be trusted.
Some of this future is already beginning to appear. Anthropic’s Project Glasswing is designed around using AI to find vulnerabilities before increasingly capable AI systems can be turned against critical software.
And the competition is expanding beyond Anthropic. On August 14, 2026, Chinese AI company Z.ai said its GLM-5.3 model had reached 84.5% on the CyberGym vulnerability-finding benchmark, compared with 83.8% for Anthropic’s Mythos 5, although Mythos 5 performed substantially better on the separate ExploitBench exploit-development benchmark.
That is an important development because it suggests AI-powered cybersecurity is becoming a competitive technology field, not simply a feature of one model.
So, What Happens to Human Hackers?
Human hackers are unlikely to disappear.
But human-only hacking may become increasingly difficult to compete with.
The researchers who adapt first could have a major advantage. Instead of competing with AI, they will use it to investigate more systems, test more ideas and spend more time on the parts of vulnerability research where human judgement matters most.
The real dividing line may therefore not be:
Humans vs. AI
but:
Humans using AI vs. humans who do not.
AI can search faster.
It can process more code.
It can generate more possibilities.
But someone still needs to decide which discovery matters, whether it is real, how dangerous it is and what should happen next.
For now, that someone is still human.
AI is changing bug hunting from a largely manual craft into a collaboration between human expertise and machine-scale analysis.
The technology could make vulnerability discovery dramatically faster, but it also creates new problems: false reports, verification bottlenecks, faster exploitation and a growing need for automated defence.
The biggest change may not be that AI takes bug bounty hunting away from people.
It may be that the definition of a good bug bounty hunter changes completely.
The next generation of security researchers may not be those who can search the most code themselves.
They may be the ones who know how to make machines search it and how to tell when the machine has found something that truly matters.
