More people are ending their bug bounty programs.

• Intel: Ended its paid bug bounty program (which offered up to $100,000) in September 2026, replacing it with a no-reward vulnerability disclosure program.
• Google: Paused product vulnerability submissions for its Open Source Software Vulnerability Reward Program (OSS VRP) starting October 1, 2026, with a planned review/update by Q1 2027.
• cURL: Terminated its bug bounty payouts at the end of January 2026
• Nextcloud: Terminated its bug bounty program

Many early bug bounty programs cited the flood of worthless AI generated reports, but that is increasingly becoming less true. Curl originally stopped in January because of a flood of low-quality AI-generated submissions that was rarely a bug, but now the tide has turned and Curl’s Daniel Stenberg is now getting good quality bug reports.