How AI Slop Is Forcing GitHub To Close Its Doors

From 27 July 2026, GitHub plans to give public security researchers a rather abrupt reality check on what they can earn.

Compensation for public researchers drops at every level, capping critical discoveries at $10,000 rather than $30,000 and high-severity findings at $5,000. Medium and low-severity payouts fall to $2,000 and $250 respectively. At the same time, the company is introducing an exclusive VIP programme, directing premium rewards above historical limits to an invited circle of researchers.

GitHub frames the policy change around two specific goals. The internal security team intends to clear away low-value noise to concentrate on critical signals. The second goal is building a structure that serious security professionals find properly lucrative.

A flood of low-effort and AI-generated vulnerability reports has made it impossible to separate legitimate research from automated spam. As the cost of generating a report drops to near zero, the commercial rationale for treating every submission as genuine research disappears.

How Does GitHub Choose Its Security Elite?

Standard application forms won’t open this particular door. GitHub issues golden tickets based purely on historical performance, setting the bar at one confirmed critical vulnerability or roughly seven valid low-tier submissions. The company is also enabling HackerOne’s “signal requirement,” which limits how many reports new researchers can submit before they’ve established a history of legitimate findings. Existing backlog reports will be assessed under the old payout rules.

Structurally, this policy moves the dynamic from an open marketplace of individual reports toward a semi-closed model governed by reputation. Independent researchers without an established track record face worse economics on high-effort work, particularly at the critical end where finding a novel vulnerability can take hundreds of hours. Newcomers are numerically capped on submissions until they demonstrate quality, which reduces the learning-by-doing pathway that many researchers used to build their reputations in the first place.

Analysts have raised concerns about a two-class researcher system. VIP selection criteria are controlled entirely by GitHub, transparency around invitation decisions is limited and there’s a risk that researchers game the system by holding back findings until VIP status is secured.
If the model proves financially effective for GitHub, other large platforms are likely to copy it. The broader public bounty market would shift toward lower public floors and gated premium access.

The Slow Death Of Open Digital Communities Under Infinite Volume

Bug hunters are hardly the only professionals currently watching machine-generated slop pollute their daily workflow.

Academic journals are tightening submission policies and requiring manual identity verification after AI-assisted manuscript factories overwhelmed peer review systems. Legal teams are adding verification layers to manage the volume of AI-drafted discovery documents and filings. Newsrooms are spending more resource on triage of AI-generated pitches than on actual reporting.

Each industry is running into the same wall. Spaces designed around trusted work from dedicated specialists are suddenly buried under cheap volume from users facing near-zero costs to submit content. The community’s quality-control systems, designed for human-scale input, break under machine-scale output. The response is almost always the same: invitation systems, reputation requirements or verified credentials. Communities that were open closed themselves, one gate at a time.

Why GitHub Specifically Matters

GitHub hosts a large share of the world’s open-source software supply chain. How it structures incentives for finding and reporting vulnerabilities has effects beyond its own products. If high-value vulnerability hunting becomes effectively invite-only at major platforms, the distribution of who discovers and discloses critical bugs over time could narrow. This policy influences talent diversity, the speed of bug disclosures and where priced-out researchers ultimately go.

The problem is an authentication gap that closing access doesn’t solve. Most submission systems were built on the assumption that the effort required to produce good work was itself a filter. Remove that effort barrier with AI tools and the filter disappears. Invite-only tiers replace the effort filter with a reputation filter, which works for researchers who already have reputations and makes it more challenging for new ones to develop them. The AI-slop problem gets managed, the access problem it creates is inherited.