Quick thoughts on the events I missed over the past two months: - The XRP bug is a great finding, but the reward was low. But even Ethereum had a $250k max bounty a few months ago, so I wouldn’t criticize Ripple too hard. - The max cap wasn’t specified in the XRP bounty program, so most hunters didn’t even bother checking it. - The $50k Vercel bounty is too low. They advertised a $1 million bounty, which is misleading, since there's a $50k max cap. Are they expecting 20 Criticals? - Other projects continue lowering their bounties or closing programs while hacks increase. I understand that it hurts to pay so many reports, but there’s no coming back from a hack. - The “Duplicates” problem hasn’t been solved. You can still report a Critical issue, prevent major damage to a project and its users, and they will still try to find a way to pay you nothing while pointing to some non-impactful report as sharing the same root cause. Platforms should address this scam immediately. - The LLM decompilation movement is pretty cool. It's the end of the era of closed-source code. - People building security tools that depend on LLM tokens should try to make a profit today, or have a clear plan to sell their company before models get better. There's no long-term plan. - LLM spam continues to be the main trend for getting bounty rewards. It feels like buying lottery tickets. The more tokens people spend, the more chances they have of landing an actual exploit. Having a unique approach seems to help too. But nobody is performing much better than the model they use, since there's no clear outstanding winner in the leaderboards. - We’re getting to the end of 2026, and bounty rewards paid haven’t increased 10x with AI. According to Grok, for the top 100 on Immunefi the total earnings were: * 2026 $16M, 1364 reports * 2025 $11M, 820 reports * 2024 $21M, 775 reports * 2023 $17M , 559 reports * 2022 $57M, 443 reports - What happened with Ledger is worrisome. Keep improving your OpSec, whitehats. Personal thoughts: We keep seeing more and more bugs in all kind of software. That's not because of superhuman AI capabilities. It's because how bad we've been building software over decades in terms of security. Nobody cared about exploits because they were difficult for the average hackers. Now everyone has a low-level-IQ tool that can crack neglected code, and we see the results. We're in a transition phase, where LLMs trained with human bugs are outperforming the average guys. We'll probably get to an era of LLMs-code-first, with LLM bugs that with unprecedented vulnerabilities. Yes, LLMs are just that bad at coding, and the current models might not be able to see some obvious errors, since they also have "cognition bias". I see a bright future for bounty hunters, full of vulnerabilities waiting to be found and prevented. We just need to solve the bug-pocalypse first if we don’t want blackhats to win.