AI has led to a zero-day bug discovery crisis, and it's getting worse

Tech companies and open-source teams are facing a deluge of AI-discovered software vulnerabilities. Now we're starting to get a sense of how big a deluge it is. The Zero Day Initiative, the largest vendor-agnostic bug bounty program in the world, has already seen a 490 percent increase in submissions this month compared to April last year, according to data provided to Mashable. And the month isn't even over yet. "Organizations that receive bug reports are struggling to keep up with the triage and response process,” Dustin Childs, Head of Threat Awareness at the Zero Day Initiative, told Mashable. “A couple of programs, most notably the Internet Bug Bounty program, completely shutter[ed] their doors rather than try to keep up.” On March 27, the Internet Bug Bounty Program announced it was closing submissions entirely because of the bug submission crisis — which it said was changing the entire "landscape" of bug discovery. “AI-assisted research is expanding vulnerability discovery across the ecosystem, increasing both coverage and speed,” HackerOne, the group that administered the program, said in a statement. “Accordingly, we are pausing submissions while we consider the structure