End of bug bounty programs
More people are ending their bug bounty programs. Most cite because there’s been a flood of AI generated bug reports.
- Intel: Ended its paid bug bounty program (which offered up to $100,000) in September 2026, replacing it with a no-reward vulnerability disclosure program.
- Google: Paused product vulnerability submissions for its Open Source Software Vulnerability Reward Program (OSS VRP) starting October 1, 2026, with a planned review/update by Q1 2027.
- cURL: Terminated its bug bounty payouts at the end of January 2026
- Nextcloud: Terminated its bug bounty program
Many early bug bounty programs cited a flood of worthless AI generated reports, but that is increasingly becoming less true. Curl originally stopped in January because of a flood of low-quality AI-generated submissions that was rarely a bug, but now the tide has turned and Curl’s Daniel Stenberg is now getting good quality bug reports. Everyone from Microsoft to the Linux have had dramatic 2x-10x increases in CVE fixes each release.
So, I suspect everyone is trying to absorb the mass of AI discovered bugs (Project Glasswing) and then we’ll likely return to a more normal bug bounty environment. That pre-supposes the number of bugs AI finds will actually decrease over the next few months…
