Coinbase Warns AI Could Triple Bug Reports
Artificial intelligence is increasing the workload of security teams.
1Surge in AI-Generated Reports
Coinbase revealed that bug reports submitted through HackerOne in the first half of 2026 could triple compared to the previous year. However, only 4% of these reports contained valid and rewardable security vulnerabilities. The decreasing cost of AI tools allows security researchers to rapidly scan software and generate numerous reports, significantly increasing the workload of human review teams.
2Decline in Valid Report Rate
While 14% of reports were valid in 2024, this rate dropped to 4% in the first half of 2026. Coinbase attributes this decline to the rise of automatically generated AI reports. 44% of reports were duplicates, 37% contained no exploitable flaw, and 15% were marked as invalid. The company has limited its Web2 program to only high, critical, and extreme vulnerabilities.
3Human Researchers' Discovery
Independent researchers Joe Almeida and Anh Nguyen uncovered a subtle weakness in Coinbase's Stellar withdrawal reconciliation process. Stellar's fee-bump mechanism allows a third party to wrap an existing transaction and pay a higher network fee. Under certain conditions, Coinbase's system could mark the original transaction as failed, creating potential double-counting in internal accounting.
4Where AI Fell Short
While AI missed this nuanced vulnerability, human researchers identified it through deep analysis of protocol rules and internal accounting processes. Coinbase paused the affected process, confirmed a correction, and resumed normal operations. Customer funds remained unaffected, and no exploitation beyond the researchers' proof of concept was found.
5AI-Assisted Bitcoin Audit
An AI-assisted Bitcoin security audit identified 4,962 potential findings across 390 repositories during a 27.5-hour review. However, only one-fifth had been independently verified at publication, requiring human confirmation for the remaining alerts. This highlights both AI's rapid scanning capability and the continued importance of human verification in security processes.
6Criminals Also Leverage AI
The FBI warned that generative AI helps criminals produce convincing messages, automate operations, and expand their pool of potential targets. An August 10 analysis of North Korea-linked Kimsuky activity revealed AI platforms generating phishing materials targeting virtual assets, financial investments, and software development.
7Industry Developments
The Tycoon 2FA phishing service used technology that intercepted active sessions and captured tokens used to bypass multifactor authentication. A coordinated operation removed 330 domains linked to this activity. Onchain security assessments identified 212 exploits and $1.1 billion in losses during the first half of 2026.
8User Security Measures
While exchanges expand automated reviews, individual security practices remain crucial. Secure wallet backups, strong password management, and two-factor authentication remain standard protections. Coinbase maintains unchanged Web3 rewards while focusing public Web2 bounty payments on high-impact flaws. The company is also laying off 700 employees due to weak crypto market conditions and AI-driven productivity gains.
Original article: Bitcoin News — Coinbase'de AI Kaynaklı Hata Raporları Üç Katına Çıkabilir