In January, the maintainers of curl, a piece of open-source software so ubiquitous it runs in everything from cars to space hardware, did something almost unthinkable – they shut down their paid bug bounty program. Surprisingly, the reason wasn’t a lack of interest from researchers; it was too much of the wrong kind.
An explosion of AI-generated “slop” reports – plausible-sounding, well-formatted, and frequently describing vulnerabilities that don’t exist, had begun making the program more expensive to run than the bugs it caught were worth. And curl wasn’t alone; GitLab’s security team told a BSides Melbourne audience it received around 2,500 reports in the first four months of 2026, more than in the whole of the previous year. THORChain and Code4rena closed their programs. Apple imposed submission caps and promptly had its portal turn away a genuine macOS exploit chain because the researchers who found it had hit their limit.
The economics are brutal in their simplicity here. A large language model can generate a “critical finding” for pennies in seconds, but a human analyst still has to spend real hours determining whether it’s real. When every report looks the same on intake, the temptation is to dismiss everything, and dismissed reports have a track record of resurfacing as multi-million-dollar incidents.
Into this mess stepped an unlikely fixer. A British hacker who has spent more than ten years on the other side of those programs.
Poacher turned gatekeeper
Jacob Riggs has, by his own count, responsibly disclosed vulnerabilities to thousands of organizations over the past decade. He has watched, from the outside, how those disclosures are often handled by overstretched teams manually trying to navigate noise.
Now he’s selling those same organizations the fix. “My go-to-market strategy is rather ironic,” he admits. “After responsibly disclosing vulnerabilities to thousands of organizations over the past decade and observing the friction in their processes, I’m simply reconnecting with those teams and offering the automated triage solution they now need.”
His vehicle for this is Bugtri, a Sydney-based startup that launched this week. And the origin story has a distinctly Australian twist.
Bugtri – Frontend Home Page
Riggs relocated from the UK earlier this year on the subclass 858 National Innovation visa – an invitation-only permanent residency pathway reserved for people with internationally recognized records of exceptional achievement. Just six months after landing, he has incorporated an Australian company, been accepted into the Australian Signals Directorate Partner Program, and shipped a working product. During his visa application period, he even found time to responsibly disclose a vulnerability in a live Australian Government system, later acknowledged by the Department of Foreign Affairs and Trade.
“Australia welcomed me through the National Innovation Visa program, and I’ve tried to contribute back by creating an innovative Australian company that now aims to solve a global cybersecurity problem,” he says.
An email filter with a security clearance mindset
Strip away the AI branding and Bugtri is, at its heart, a very opinionated email layer. It connects to a company’s shared security mailbox over OAuth via Google Workspace or Microsoft 365, and gets to work on everything that lands there.
Connected Mailbox Example
CTO Harry Coles describes the onboarding in terms that will sound suspiciously frictionless to anyone who has deployed enterprise security tooling: “Connecting Bugtri takes under two minutes. You authorize your shared mailbox via OAuth, and it just works. No agents, no infrastructure, no passwords stored.”
From there, the pipeline runs in minutes. Non-vulnerability emails are filtered out and real reports routed into labeled folders. Each report is scored by AI and returned to the inbox as a structured triage summary.
Two design decisions stand out for a product handling some of the most sensitive email a company receives.
The first is what the AI doesn’t see. “We’re not just bolting AI onto triage,” Riggs says. “We automatically sanitise reports by tokenising sensitive information such as URLs, IPs and contact details before anything is sent to AI”. Real infrastructure details are swapped for placeholder tokens before analysis and restored only in the email the customer reads.
The second is institutional humility. If the AI’s self-assessed confidence dips below a configurable threshold (40% by default), it is not allowed to auto-decline anything. The report is forced into a human review queue instead. Scoring weights, thresholds, and multipliers are all adjustable, with optional and convenient presets. “The AI makes a recommendation, but the team can override any decision with one click,” Coles notes.
User Dashboard – Scoring Configuration
Given that the industry’s worst horror stories this year are about real bugs being filtered out and not fake ones getting through, that fail-open-to-humans posture may prove to be the platform’s most important feature.
The numbers, and who they’re for
Bugtri’s target customer is not the Fortune 500 SOC, but SMBs. It’s the organizations that receive vulnerability reports but without the resources to triage them, and who are now on the receiving end of a 62% year-over-year rise in low-quality submissions that Riggs attributes largely to AI.
His pitch to them is rather arithmetic: “For a team receiving 80 reports a week, we’re cutting triage time from roughly 33 hours down to about 3. That’s real, measurable ROI, often paying for itself in the first month.”
Early traction suggests the message lands. Three weeks of early access brought 27 applications, with 11 organizations now actively using the platform. The company is entirely bootstrapped with no venture capital, no external funding, and Riggs says Bugtri’s capabilities will be offered on a not-for-profit basis where they can support Australia’s cybersecurity interests, a commitment made alongside the ASD partnership.
Fighting a treadmill with a treadmill
There is no pretending Bugtri escapes the strange loop it operates in. AI-generated reports created the triage crisis which Bugtri ironically answers with AI-powered triage. Report-generation tools will keep improving and so, presumably, must the filters. The Open Source Security Foundation’s Vulnerability Disclosures Working Group launched dedicated work this year on exactly this problem, which suggests nobody expects it to resolve itself.
Riggs, for his part, isn’t claiming a permanent victory here, just a necessary rebalancing. “Manual human triage worked when every report was written by a human who had to think about what they were submitting,” he says. “Now the only way to fight the AI-generated noise is with purpose-built AI on the triage side.”
He may be right that there’s no way back. The question the next twelve months will answer is whether the triage side of the arms race can keep pace with the generation side.
