Mackenzie Jackson: Hello everyone and welcome to another episode of The Secure Disclosure. My name is Mackenzie Jackson and this is your weekly news brief. Today we're going to do a little bit of a deep dive into two topics. First up, we're going to be talking about the plight of AI slop in bug bounty programs. There are a lot of companies removing their bug bounty programs. We're going to talk about the impact of this and what it could mean for the future. Next, after that, we're revisiting our old friend OpenClaw. As fast as OpenClaw popped up, it appears that there are some key people in the community that are actually going to start helping to try and solve this, including some of the researchers that were actually pointing out its weaknesses in the first place. The bug bounty world has been really struggling with the adoption of AI. If you're not familiar, a bug bounty program is where ethical hackers can submit vulnerabilities to organizations or projects where they get monetary value for that. It's a great exchange of services and skill. Bug bounty programs have been a big part of a lot of companies' security posture and they also help making sure that some of the best names and talent out there in the world of security don't go to the dark side. But if we take this all away, well, we're opening not only ourselves up to have a lot more vulnerabilities and blind spots in our security posture, but also to see a lot of talent disappearing. It's all come to a little bit of a head when cURL announced that they're removing their bug bounty program. Daniel Stenberg wrote in a blog post to explain why they're doing this, and it basically comes down to the point that AI generates way too much slop reporting. Essentially, anyone can submit a bug bounty report. They can string together some tools, maybe sprinkle on some AI to try and find some vulnerabilities in a website. The problem is if they don't have the knowledge to be able to understand that, understand its implication, they're just going to generate very complex, very long reports that end up in nothing. This isn't the first time that Daniel has been talking about the plight that is AI slop reporting, in a post that he made back in January of 2024, two years ago, and he made a point that really resonated on this topic, and that is that better crap is worse than obvious crap. And basically what it means is that a while ago, you would get crappy bug bounty reports. This thing isn't new. Now they're just more convincing. And because they're more convincing, it takes longer to prove that that's actually full of crap. So, it's not just about the volume of bug bounty reports that they're getting, which has increased drastically with the amount of slop. It's also about the fact that these are more complex reports. They take longer to go through and you don't really know if it's just AI slop until you start trying to recreate the exploit. And as Daniel has concluded, bug bounty programs just aren't really worth it anymore. So, how many of these reports are actually just crap? Well, the acceptance rate, that is the rate at which a bug bounty is accepted for a report, is less than 5% now in cURL, which means 95% of your inbox of your reports is crap. You can also add in something that's called spam economics. It's basically the economics behind these spamming reports. And essentially, you can generate a very complex, very long report in a matter of minutes, but it may take hours to disprove it. And you have to do that for every report, because if you can't do it for every report, what's the point of having a program? Because you're going to miss the 5% that are accepted, which is the conclusion that cURL has come to, there's no point in having this program. It's taking too much time. Now, there is another point of this that maybe should be discussed, and that is that bug bounty programs when they first open up often receive hundreds of reports because there's some low-hanging fruit that security engineers are good at finding. Now, Daniel's argued that perhaps part of the reason why the drop-off rate to 5% is so big is because this low-hanging fruit has been found. I don't necessarily agree with that, but it is a point worth taking into account. cURL is arguably one of the most important projects on the internet, but are they alone in dealing with this problem? And the answer is no. There are a lot of organizations going through this exact process. CycloneDX removed their bug bounty program for the same reason: AI generated slop reporting. Node.js have admittedly kept their program open, but have had to increase their HackerOne score that a user must have to submit a bug bounty. This basically means that only experienced users can submit reports. Now, while this does help with getting rid of some of the AI slop, it also means that other ethical hackers that perhaps haven't been on HackerOne before or are new to the industry but very talented won't be able to submit it, which will have a big impact if everyone starts doing this. Open Collective have also reported the same inbox spam problem and stated that they'll have to move to programs like HackerOne so that they can apply a quality gate to reduce some of this AI slop. There are some signals from engineers working for the Apache Foundation that the Log4j bug bounty program may have to shut down. And I'll remind you about the trauma of Log4j of 2021. Now, one question you may have is, okay, what do these reports actually look like that are from AI? Is there anything to them? Is it just complete garbage? Are they just hoping that someone's going to give them money so that they go away? Well, Django's post from a few days ago actually talks about this. They've talked about the shift in security and what they're seeing is that they're getting a huge amount of duplicate reports or perhaps slight variations of previously reported or fixed bugs. What makes it difficult is that when you read the report, there are some plausible signs in there that this could be a workable exploit because LLMs are very good at finding plausible things, but plausible is not definitive. So what researchers, if you want to call them that, are doing is taking previously existing bugs, feeding them into LLMs and asking it to come up with plausible alternatives of configurations or use cases that could generate a bug and they're submitting that report. Now, they probably don't have the skills to validate that, so they just submit the report. Someone else will validate it anyway when they read through your 40-page report that doesn't end up being a vulnerability, which is kind of crazy. In essence, when you look at this, it's kind of like a DOS attack, but with AI reports instead of traffic payloads, which could lead you to kind of a somewhat plausible explanation that maybe this is malicious activity. Maybe attackers are targeting and getting these bug bounty programs to close down so that they have easier targets. It's a little bit of a stretch, but Daniel does address this. He says that genuinely he doesn't feel that these are malicious attempts. What he does feel though is that these are well-meaning people that are misled and often absorbed by the hype of AI. They're trying to maybe get into security and looking for shortcuts, like I guess we all are right now. After all, you can build an app that probably won't work with a single prompt. So why can't you generate a bug report that probably won't work with a single prompt? Here comes the other side of the equation, one that's important to talk about as well. And that is, what about the good AI hacking? There are seemingly endless amounts of AI pentesting companies. At Aikido, we have released AI pentesting. Expel has released pentesting. Horizon3 has released AI pentesting. And a lot of these are proving themselves through bug bounty programs or CVEs. For example, the Aikido pentesting found several vulnerabilities in massively popular open-source projects that did get CVE numbers that were legitimate. Expel famously went to the top of the leaderboards in HackerOne. So, what's the difference? Well, behind the scenes of an AI pentest, it actually takes quite a lot of computational power. And whilst most pentests do take less than a day, they do actually take several hours. Running LLMs for several hours is costly. And this isn't quite the use case of AI that a lot of these reports are coming in from. So you kind of have a dilemma where AI could be helping improve security, but it's also being a massive hurdle at really what is the exact same time. The problem right now is that the economics of bug bounties no longer work. By that what I mean is it's cheap to submit a bug bounty report and it's expensive to review one. So this needs to balance out. Now there's two ways that this can balance out and how it happens. Now we've seen one way, making it more expensive at least in time and effort to submit a bug bounty report. This is what we're seeing with the gating around places like HackerOne that people can't submit a report unless they meet certain requirements. Or the other way is to reduce the cost of validating a report or at least quickly be able to validate and get rid of some of them. And this is where actually AI comes in for a really good use case. So what does kind of using AI in bug bounty programs actually look like? Well, I can actually show you exactly what that looks like. Now, the sponsor of this podcast, Aikido Security, in response to the growing drama around all of this has created a bug bounty AI validation report. Now, usually I run ads in the podcast, but I'm just going to make this the ad, seeing as I'm talking about the sponsor, but basically what you can do in the Aikido dashboard is actually submit bug bounty reports. The AI will then validate them by trying to recreate the steps for you and give you a detailed explanation as to why this bug bounty report may or may not be valid. But perhaps the craziest thing about this is if Aikido is integrated into your systems, then it can actually give you the code and create a pull request to fix that bug bounty flaw as well. So what this actually does is goes back to the economics that we're talking about. Instead of trying to increase the cost for the bug bounty reporters, let's decrease the cost of actually validating them and relieve the security engineers of these companies of dealing with this AI slop. You remember last week I sat down with Paul McCarthy, a security researcher who discovered hundreds of malicious skills in Clawhub, OpenClaw's registry of skills that the AI agent for OpenClaw can actually perform. There has been a lot of negativity from the security team around OpenClaw. Now, some of it I think is totally valid, but you've got to be directed in the right spaces. Now, one such researcher that we covered in last week's episode was Jameson O'Reilly. And to recap, what Jameson was able to do is basically manipulate Clawhub so that his malicious skill became the number one downloaded skill. Now, it was pretend malicious. Jameson was doing this for the purpose of showing the security flaw. And it got a lot of attention. And OpenClaw has been absolutely the hottest topic for a lot of security people. Well, I'm pretty happy to see that Jameson has teamed up with OpenClaw and its founder Peter Steinberger to actually start trying to make OpenClaw or Clawhub a better space and I think this is really cool. I always agree with pointing out security issues and I'm certainly not going to be downloading OpenClaw anytime soon. But it is cool to see that it's not just criticism, it's action that the community actually takes, which is nice. In addition to that, there is some action being taken to try and figure out if skills are malicious. VirusTotal has also announced that they're going to be running some scans on Clawhub skills to make sure there's no malware inside of it. I think this is an awesome step. I don't think that this means that skills will be safe purely because we're talking about LLMs. And whilst the malware that has been predominantly found on places like Clawhub has been what Paul McCarthy described as kind of dumb malware, it's just trying to download malicious executables or binaries and it's trying to exploit payloads that way. Whilst we can find out if those types of payloads are malicious, it's much harder if we start getting into the realm of malicious prompts or malicious intent or perhaps updating skills. Now, this isn't to say at all that we shouldn't be doing security things exactly like this for Clawhub and on OpenClaw, but I want to be clear that I'm not advocating for anyone to be using Clawhub or OpenClaw as I still have some questions. But I'm very happy to see that at least it's taken a bit of a secure direction. Alright, and that's all I had for you today. Make sure you subscribe to the channel and like this video or give us a five-star review wherever you're watching. We release two episodes every week. Thought leadership episodes on Tuesday and news briefs on Thursday. So make sure you subscribe to next week's episodes coming out. I'm Mackenzie Jackson. This was a Secure Disclosure. And as always, make sure you stay safe and stay secure.
