AI Finds Authorization Bugs Fast, But Filtering False Positives Is the Real Challenge

Bug bounty platforms including Nextcloud and Mattermost have scaled back or suspended their programs in 2026, citing an influx of low-quality, AI-generated vulnerability reports that overwhelm triage teams. A security researcher argues the critical skill is no longer generating candidate bugs but accurately disproving the false positives among them. The proposed two-stage method uses cheaper AI models to broadly scan for potential authorization flaws, then applies high-reasoning models to rigorously refute each candidate before reporting. A worked example using open-source identity server Ory Kratos showed a seemingly suspicious missing ownership check in its OIDC settings flow, which deeper analysis confirmed was not exploitable. The case illustrates that trustworthy security research depends on documented refutations, not just a list of unverified findings.