Turso shuts down bug bounty program: AI spam submissions drive companies into corners

Database startup Turso has announced it is shutting down its nearly year-old bug bounty program after being inundated with junk AI-generated vulnerability reports. The team received a large number of fake vulnerabilities fabricated by LLM, and the maintainers had to spend a lot of time distinguishing the real ones from the fake ones, and finally decided to shut down the program completely. This incident reflects the real impact of AI-generated content on the field of security research.

Core conclusion

On May 12, 2026, database startup Turso officially announced the closure of the bug bounty program that had been running for nearly a year. The reason wasn’t a lack of budget, or a technical bottleneck—it was AI-generated garbage vulnerability reports that completely overwhelmed the review process.

Glauber Costa, CTO of Turso, said bluntly in his blog: "Everyone is being swamped by the garbage-making machine." This news received 347 votes on HN today, sparking widespread discussion - when low-quality content generated by AI spreads from content creation to the field of security research, the efficiency dividends brought by **AI are back-eating the trust infrastructure. **

Key Points

Event Time: 2026-05-12 (announced on the blog on Friday, HN fermented to 347 votes this week)
Affected objects: AI automation practitioners, teams that rely on the security ecosystem, AI Agent developers
Core changes: Fake vulnerability reports generated by AI lead to out-of-control manual review costs and the collapse of trust in the bounty mechanism

Background and trigger events

Turso is a company that provides cloud services around its distributed database (libSQL), which is a rewrite of SQLite. In mid-2025, they launched a bug bounty program: TOK1__ for every vulnerability discovered that leads to data corruption.

During its run, they managed to pay five researchers, some of whom were even recruited to join the team for their abilities. But the good times didn't last long - "Overnight, a flood of garbage reports came in."

How does AI "bypass" bounty programs?

The Turso team listed several typical types of AI-generated vulnerability reports:

Type	Description	Outrageous
Manually inject corrupted bytes	Write garbage bytes into database files and then call "data corruption"	⭐⭐⭐⭐⭐
Modify the source code to create vulnerabilities	After manually adding out-of-bounds access in the code, report "The vulnerability was discovered by me"	⭐⭐⭐⭐⭐
Fake concurrency test	After enabling Turso's unique concurrent writing function, it says that SQLite cannot open the file	⭐⭐⭐⭐
Meaningless output	I can’t understand what I’m doing at all, even the description looks like garbled machine translation	⭐⭐⭐⭐⭐

The most ironic thing is that Turso once tried to introduce a "vouching system" - if a submission is suspected to be from a robot, it will be automatically closed. But this can only barely block the most obvious wave of attacks, and the real bottleneck is: **The time that maintainers spend distinguishing authenticity has exceeded the time of writing code. **

Key Impact (by Dimension)

Dimensions	Change	What it means to us	Recommended actions
Trust cost	AI has caused the trust cost of security audits to soar	Automation practitioners need to establish a more rigorous verification layer	See adaptation suggestions below
Security Ecosystem	The effectiveness of bounty programs has declined, and trust in the security community has been damaged	Teams that rely on third-party security audits need to find alternatives	Proactively build internal testing pipelines
Testing strategy	Increased importance of automated testing + formal verification	The reliability of AI-generated tests requires manual secondary verification	Add the basics of fuzz testing to CI/CD
Industry trends	More companies will follow suit and shut down bounty programs	Open source project security may face new challenges	Pay attention to security community responses

Adaptation suggestions

The inspiration of these two stories for AI automation practitioners is consistent: **AI output requires layered verification and cannot be blindly trusted. **

Incorporate quality gates into automated workflows: Don’t assume that the AI’s output is correct. For the extraction of important fields and the generation of API call parameters, schema verification + retry mechanism must be passed.
Observability first: If the team relies on AI to handle security-sensitive data, ensure there are complete audit logs for every step
Exponential backoff + manual review threshold: When the AI output is abnormal (parameter exception, result format deviation exceeds the threshold), it will be downgraded to manual confirmation

Task List

Check if the automation pipeline does schema validation instead of string matching on the AI output
Add manual confirmation to key error handling paths
Pay attention to Turso's "Spam Report Identification Tool" open sourced for the community (if it is open sourced in the future)

Example: Quality gate in automated assembly line

python


# AI
def validate_ai_extraction(extracted: dict, schema: dict) -> bool:
    for field, expected_type in schema.items():
        if field not in extracted:
            print(f"[WARN] Missing field: {field}")
            return False
        if not isinstance(extracted[field], expected_type):
            print(f"[WARN] Type mismatch: {field} should be {expected_type}")
            return False
    return True

（）

，AI 。 OpenAI、ChatGPT、Claude、DeepSeek ，。n8n Hermes Agent When this type of automation platform orchestrates workflow, the quality gate module is an essential component.

Turso shuts down bug bounty program: AI spam submissions drive companies into corners

Core conclusion

Key Points

Background and trigger events

How does AI "bypass" bounty programs?

Key Impact (by Dimension)

Adaptation suggestions

Task List

Example: Quality gate in automated assembly line

（）

Related extended information

Related reading

How can you make money from this trend?

n8n + OpenAI affiliate site

Claude + n8n automation agency

Related tutorials

Related news