The AI Amplification Effect: Expert + AI = 10x, Novice + AI = -20x

TL;DR: AI amplifies what you already are. Expert security researchers using AI are finding 1,060+ vulnerabilities and topping HackerOne leaderboards. Novices with AI are generating such garbage that curl — a 27-year-old project with 20 billion installs — just shut down its entire bug bounty program. The middle class of hacking is dead. You’re either building systems on top of AI with real expertise, or you’re drowning everyone in slop.

🔥 Two Stories, One Technology

February 2026. Two announcements.

First: XBOW, an autonomous AI penetration tester, hits #1 on the HackerOne US leaderboard. First time in bug bounty history. They submitted 1,060 vulnerabilities. 130 resolved. 303 triaged. Over half rated high or critical severity. They found an unknown vulnerability in Palo Alto’s GlobalProtect VPN affecting 2,000+ hosts. Real impact. Real money. Real recognition.

Second: Daniel Stenberg, creator of curl, shuts down the project’s bug bounty program after seven years. Not because they’re done. Not because they ran out of money. Because the confirmed vulnerability rate dropped from 15% to under 5%. “The never-ending slop submissions take a serious mental toll,” he writes. “Time and energy that is completely wasted while also hampering our will to live.”

Same month. Same technology. Opposite outcomes.

One team used AI to amplify expert security knowledge and topped the most competitive hacker leaderboard in the world. The other watched AI destroy a program that had successfully paid out over $100,000 and confirmed 87 vulnerabilities over seven years. The curl bug bounty didn’t die because bug bounties don’t work. It died because AI turned every script kiddie with ChatGPT into a false-positive fire hose.

This isn’t a cute case study. This is the watershed moment for our industry. The amplification effect is real, it’s brutal, and it’s already sorting us into two camps: those who build on foundations, and those who generate garbage at scale.

⚡ The Amplification Effect Explained

AI is a force multiplier. Not a replacement. Not a shortcut. A multiplier.

If you’re an expert, AI takes your pattern recognition, your exploitation techniques, your deep understanding of how systems break, and lets you apply it across 1,000 targets simultaneously. You encode decades of knowledge into prompts, validators, and scoring systems. You teach the AI to think like you do after 10,000 hours of breaking things. The result? You 10x your output while maintaining quality.

If you’re a novice, AI takes your lack of understanding, your inability to verify findings, your cargo-cult copying of vulnerability descriptions, and amplifies that across 1,000 reports. You’re not learning. You’re not building expertise. You’re farming garbage at industrial scale, hoping something sticks long enough to collect a bounty. The result? You become a productivity black hole. You generate negative value.

This is why XBOW built validators — automated peer reviewers that confirm each vulnerability before submission. Custom programmatic checks. Headless browsers verifying XSS payloads actually execute. Large language models evaluating edge cases. They didn’t just point an AI at targets and hope. They built infrastructure on top of AI to ensure accuracy. That’s the expert approach. That’s the multiplier in action.

Meanwhile, the novice approach? Copy-paste AI output. Submit. Pray. Repeat 50 times a day. No validators. No verification. No understanding. Just volume.

The math is brutal. If you’re an expert with a 15% true positive rate and AI lets you test 10x more targets, you go from 15 good findings per 100 tests to 150 good findings per 1,000 tests. If you’re a novice with a 5% true positive rate (and that’s generous), AI lets you spam 1,000 garbage reports to find 50 real ones — but you’ve now burned 950 hours of maintainer time. You’ve made the world worse.

💀 What AI Slop Looks Like

Let me tell you what lands in my inbox.

“Critical SQL Injection vulnerability detected in authentication endpoint.” The report includes a payload. The payload doesn’t execute. The reporter insists it’s exploitable “in theory.” They argue for 20 messages. They never once provide working proof of concept. Eventually they ghost when I ask them to run it themselves.

Or: “Server-Side Request Forgery allows access to internal metadata endpoints.” The “SSRF” is a redirect to a public documentation page. The reporter doesn’t understand what SSRF means. They saw AI flag something with “internal” in the URL and submitted it. Zero comprehension. Maximum confidence.

I receive terrible AI-generated bug bounty reports regularly. The pattern is always the same. Wall of text. Lots of technical terms. Zero working exploit. When you push back, they can’t explain it. They don’t understand their own report. They copied it from somewhere — either an AI or another researcher — and hoped volume would compensate for accuracy.

Immunefi, the largest Web3 bug bounty platform, started rate-limiting submissions because of exactly this. Too many garbage reports. Too many researchers using AI to spam every program with hallucinated vulnerabilities. The economics broke. Platforms had to choose between burning triagers or burning researchers. They chose researchers.

Daniel Stenberg’s experience with curl is the most documented version of this collapse. From his blog: “We saw an explosion in AI slop reports combined with a lower quality even in the reports that were not obvious slop — presumably because they too were actually misled by AI but with that fact just hidden better.” The confirmed rate plummeted from 15%+ to under 5%. Not even one in twenty was real.

He tried everything. Reputation systems. Program settings. Immediate bans for AI slop. Nothing worked. The incentive structure was too strong. As long as there was money at the end, people would spam. So he removed the money. Shut down the program. Moved to GitHub’s private vulnerability reporting. No rewards. Just reports from people who actually care.

That’s what AI slop looks like at scale. It doesn’t just waste time. It destroys programs. It makes good-faith collaboration impossible. It kills the incentive structures that made bug bounties work in the first place.

🎯 What Expert + AI Actually Looks Like

Now let’s talk about what good looks like.

I’ve built AI-powered vulnerability hunting systems. Not toy demos. Production systems that process thousands of real exploit patterns. The difference between expert AI use and novice AI use isn’t the model. Everyone has access to the same LLMs. The difference is what you build around it.

XBOW’s approach shows this clearly. They didn’t just throw Claude at HackerOne targets. They built a complete intelligence pipeline:

• Scoping infrastructure: Parse bug bounty programs. Extract domains. Expand subdomains. Score targets by value. They built tooling to identify which of 100,000+ targets were actually worth testing. Resource allocation based on expected ROI.
• Deduplication systems: SimHash for content-level similarity. Headless browsers for screenshots. ImageHash for visual similarity. When you find a staging environment vulnerability, you know which other environments to check without re-running expensive scans.
• Validators: Automated peer review for every finding. Headless browsers that verify XSS payloads execute. Custom programmatic checks for each vulnerability class. LLMs evaluating edge cases. If the validator can’t confirm it, it doesn’t get submitted.
• Feedback loops: Every submission — accepted or rejected — becomes training data. They woke up every morning reviewing creative new exploits their system found overnight. They weren’t babysitting the AI. They were learning from it.

That’s expert + AI. You’re not using AI to replace your knowledge. You’re using AI to scale your knowledge. You’re encoding pattern recognition. You’re building verification infrastructure. You’re treating AI as a tool that requires mastery, not a magic button.

My own workflow looks similar. When I use AI for security research, I’m not asking it “find vulnerabilities in this contract.” I’m feeding it context. Specific patterns I’ve seen before. Edge cases from past exploits. Custom verification steps. The AI helps me move faster through the mechanical parts — reading code, checking patterns, generating test cases — so I can spend more time on the parts that require expertise: exploitation chains, business logic flaws, novel attack vectors.

The AI doesn’t know more than me. It moves faster than me. That’s the difference.

And that’s also why I can spot garbage AI reports in seconds. When someone sends me a report that claims a critical vulnerability but can’t explain the exploitation path, I know they didn’t build verification infrastructure. They just asked ChatGPT “is this a vulnerability?” and submitted whatever it said. No validator. No expertise. No value.

🛡️ The Middle Class of Hacking is Dead

For years, security had a viable middle class.

You didn’t need to be a research-level expert. You didn’t need to discover novel attack classes. You could learn common vulnerability patterns, run good scanners, manually verify findings, write clear reports, and make a decent living. Maybe you weren’t topping HackerOne leaderboards, but you were solving real problems and getting paid real money.

That’s over.

AI collapsed the middle. Anything a moderately skilled researcher can do, AI can do faster and cheaper. Basic XSS? Automated. SQL injection? Automated. SSRF? Automated. The entire bottom 80% of bug bounty work is now a race between AI-powered experts and AI-powered novices. The experts win because they built validators. The novices lose because they’re competing on speed in a game that now rewards accuracy.

If your value proposition was “I’m pretty good at finding common vulnerabilities,” you’re done. AI is already better. If your value proposition was “I understand systems deeply and can find complex exploitation chains,” you just got a force multiplier. You’re going to 10x.

This is true across all of software security, not just bug bounties. Smart contract auditing. Penetration testing. Red teaming. Cloud security. The middle is collapsing. Either you specialize at the top — novel research, complex business logic, custom tooling, strategic risk — or you get automated away.

I’ve been doing this for 27 years. I’ve seen tool revolutions before. Metasploit. Burp Suite. Static analyzers. Every time, the same thing happened: commoditized the bottom, elevated the top. But AI is different. It’s faster. It’s more complete. And it’s already here.

The researchers who survive are the ones who treat AI like a junior analyst, not a replacement. You set strategy. You build infrastructure. You verify findings. You understand the fundamentals well enough to know when the AI is hallucinating. That’s expert + AI. Everything else is noise.

💡 What This Means for Your Career

If you’re starting in security right now, this is your wake-up call.

You cannot build a career on surface-level vulnerability hunting. You cannot learn security by copy-pasting AI output. You cannot compete by running automated scanners and hoping. All of that is already over. AI won that game. The only question is whether you’re using AI to amplify real expertise, or using AI to pretend you have expertise.

Learn the foundations. Actually learn them. Understand how authentication works at a protocol level. Read RFCs. Write exploits by hand. Build broken systems and then break them. Study real vulnerabilities until you understand not just what happened, but why it happened and how someone found it. That’s the expertise AI amplifies.

When I coach the Spanish team for the European Cybersecurity Challenge, I don’t teach them to use AI. I teach them to think like attackers. To understand systems. To recognize patterns. Once they have that foundation, AI becomes a tool. Without that foundation, AI is a crutch that makes them worse.

If you’re already mid-career, this is your forcing function. Specialize or die. Pick a domain and go deep. Smart contract auditing. Cloud architecture. Binary exploitation. DeFi protocol design. Something where your expertise compounds and where AI can’t just replicate you by reading the internet. Build systems. Build tools. Build reputation. Become someone who uses AI agents to scale their work, not someone whose work gets scaled away by AI agents.

And if you’re senior, this is your opportunity. The gap between expert + AI and novice + AI is now visible to everyone. Companies are figuring out that AI-generated slop is worse than useless. They’re figuring out that real vulnerability detection requires real expertise. The ones who can build AI-powered security infrastructure — not just use AI, but architect around it — are going to capture disproportionate value.

XBOW proved this. They took expert security knowledge, encoded it into an autonomous system, and outcompeted thousands of human researchers. That’s the future. You’re either building that future or competing with it. Choose carefully.

The amplification effect is not a metaphor. It’s math. Expert + AI = 10x because you’re multiplying signal. Novice + AI = -20x because you’re multiplying noise. The middle class of hacking is dead. The only question is which side of the amplification you’re on.

---

⚡ XBOW found 1,060 real vulnerabilities and hit #1 on HackerOne. curl shut down its bug bounty because of AI-generated garbage. Same technology, opposite results.

The difference isn’t AI — everyone has AI. The difference is the security expertise underneath. That’s exactly what the Master Program teaches.