Coinbase (NASDAQ:COIN) has highlighted a major shift in how software vulnerabilities are identified and reported, driven by the rapid adoption of artificial intelligence tools. The company notes that the volume of bug reports submitted through its programs is projected to reach three times the previous year’s total, following a doubling the year before.
This surge is closely linked to the growing use of AI by external researchers, which has made it far easier and cheaper to scan codebases and generate submissions at scale.
While the overall number of reports is climbing sharply, the quality of those submissions has declined.
Valid reports that result in paid bounties have dropped from 14 percent in 2024 to just 4 percent in the first half of 2026.
A large portion of the closed reports consisted of duplicates, non-exploitable informational findings, or invalid claims.
This flood of lower-value material creates significant noise, forcing security teams to devote more resources to sorting credible threats from automated or low-effort submissions.
In response, Coinbase adjusted its public Web2 bug bounty program on HackerOne.
Low- and medium-severity issues are no longer eligible for rewards, with the focus narrowed to high, critical, and extreme vulnerabilities.
Reward amounts for high and critical findings were also recalibrated to align with market conditions, while the maximum payout for extreme-severity issues remains at one million dollars.
The separate program covering crypto and smart contract vulnerabilities was left unchanged.
These steps aim to reduce the screening burden on internal reviewers and direct researcher efforts toward more complex, high-impact problems that current AI tools struggle to detect reliably.
Coinbase emphasizes that AI has transformed the economics of vulnerability discovery.
Frontier models can now analyze code and surface plausible flaws far faster than individual researchers working manually.
Defenders, researchers, and attackers are all leveraging the same technology, creating an environment where continuous automated scanning is essential.
The company’s own internal tooling has matured to catch many common issues at scale.
However, the most consequential vulnerabilities still require deep domain knowledge, creativity, and contextual understanding that AI currently lacks.
A recent example illustrates this balance.
External researchers identified a subtle reconciliation issue involving Stellar withdrawals and the protocol’s fee-bump feature.
Under specific conditions, a successfully completed on-chain transfer could be treated as failed internally, creating a risk of double-counting.
The flaw required understanding both the blockchain protocol details and Coinbase’s internal accounting logic—something AI did not readily uncover, though it did flag a related, less severe deposit-side issue.
No customer funds were affected, and the problem was quickly remediated.
The exchange is building its security approach around the complementary strengths of AI and human expertise.
Automated systems handle volume and routine detection, while skilled researchers and internal teams concentrate on novel, high-severity challenges.
Human findings also help train automated systems to recognize new patterns.
Coinbase views this combination as essential for staying ahead of evolving threats, rather than relying on either AI or human effort in isolation.
This evolving landscape underscores broader industry pressures, as similar increases in AI-assisted submissions have been reported across crypto and open-source projects. Organizations must refine triage processes and incentives to maintain effective defenses while managing the growing volume of digital security noise.
