AI can now find software bugs faster than any human. It cannot yet tell a real one from a convincing fake — and Solana's security team just put a price on that gap. Researchers reporting Firedancer flaws must now burn 1 SOL (~$100) with every submission. The fee is nonrefundable, even for invalid, out-of-scope, or duplicate reports. No burn, no bounty.

The policy, updated Monday, follows a $1 million audit competition Jump ran from April 9 to May 9. It drew 809 reports from 162 researchers — and produced just 127 unique findings. Nearly half the valid submissions were duplicates, according to CoinDesk. Jump believes AI agents helped discover or write nearly every one.

The problem isn't that AI-written reports are wrong. It's that they're cheap to produce and expensive to judge. Every report still has to be reproduced by an engineer to check whether the proposed attack actually works. "AI has made finding bugs cheap, but judging them is still expensive," Jump's Ishan Bhatt wrote in an October 16 review. The backlog peaked at 299 open reports, and about 80 percent of duplicates arrived more than three days after the original — bugs rediscovered before the first report was fixed or disclosed.

This is the other side of the AI security boom: the same month a hacker reportedly used AI agents and $5,000 to break into 100+ companies, Solana's auditors found machine-assisted findings are their own denial-of-service attack — not on the network, but on the humans guarding it. The new platform also caps each report section at 3,000 characters, a nudge toward brevity that reads like a plea.

The stakes justify the friction. The competition did surface serious flaws, including a scheduling error that could have made Firedancer execute transactions out of order and disagree with other validators about the network state. Jump is pairing the stick with a bigger carrot: eligible findings pay double through November 20 — triple for bugs in Alpenglow, Solana's new voting system, with critical Alpenglow flaws eligible for up to $300,000.

Watch whether the model spreads. Bug bounties assume finding vulnerabilities is the hard part, so they reward discovery and eat the triage cost. If AI flips that equation — discovery cheap, judgment expensive — charging to be heard stops looking like gatekeeping and starts looking like the only way to keep the inbox usable.

— via CoinDesk