Loading story…
HackerOne has reported a significant increase in bug bounty payouts, distributing $81 million to ethical hackers worldwide over the past 12 months, marking a 13% year-over-year growth. The platform, which manages over 1,950 bug bounty programs for major organizations such as Anthropic, Crypto.com, General Motors, GitHub, Goldman Sachs, Uber, and the U.S. Department of Defense, has seen its top 100 programs alone pay out $51 million between July 2024 and June 2025. The average annual payout per active program reached nearly $42,000, with the top 10 programs accounting for $21.6 million. Individual researchers are now consistently earning six-figure sums, and the top 100 all-time earners collectively received $31.8 million. A notable trend in the past year has been the dramatic rise in AI-related vulnerabilities, with prompt injection flaws increasing by 540% and overall AI security issues rising by more than 200%. This surge is attributed to both the expansion of enterprise AI security initiatives—growing at nearly three times last year's pace—and the emergence of 'bionic hackers' who leverage AI tools to enhance vulnerability discovery. In 2025, 1,121 bug bounty programs on HackerOne included AI in their scope, representing a 270% year-over-year increase, and autonomous AI-powered agents submitted over 560 valid reports. While traditional vulnerabilities such as cross-site scripting (XSS) and SQL injection (SQLi) have declined, authorization-related flaws, including insecure direct object reference (IDOR) and improper access control, are on the rise. HackerOne's CEO, Kara Sprague, highlighted the unprecedented scale at which security issues are being discovered due to the integration of AI in both offensive and defensive security practices. The company also noted that 70% of surveyed researchers have incorporated AI tools into their workflows, further accelerating the identification of vulnerabilities. The data underscores a shift in the threat landscape, with AI security becoming a primary concern for organizations participating in bug bounty programs. The increased payouts reflect both the growing complexity of vulnerabilities and the value organizations place on proactive security research. HackerOne's annual report serves as a barometer for industry trends, indicating that as AI adoption accelerates, so too does the need for robust security measures and incentives for ethical hackers. The platform's continued growth and the rising sophistication of its researcher community suggest that bug bounty programs will remain a critical component of organizational security strategies. The findings also emphasize the importance of adapting vulnerability management processes to address emerging threats, particularly those associated with AI technologies. As enterprises expand their AI initiatives, the collaboration between organizations and the ethical hacking community is proving essential in mitigating evolving risks. The report concludes that the intersection of AI and cybersecurity will continue to shape the future of vulnerability discovery and remediation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
HackerOne disclosed that it paid out $81 million in bug bounties during the preceding 12 months, marking an increase in rewards to security researchers on its platform. Multiple outlets reported the same annual payout update as a company milestone.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has introduced a new bug bounty initiative specifically targeting vulnerabilities in its artificial intelligence (AI) products and services. The program, known as the AI Vulnerability Reward Program (AI VRP), is designed to incentivize security researchers to identify and report security flaws, abuse vectors, and high-impact vulnerabilities within Google’s AI ecosystem. The scope of the program includes flagship AI products such as Google Search, Gemini Apps across web and mobile platforms, and core Google Workspace applications like Gmail, Drive, Meet, and Calendar. Additional in-scope products include AI Studio, Jules, and other AI integrations within Google’s suite. Rewards for valid vulnerability reports range from $500 to $30,000, with the highest payouts reserved for novel, high-impact discoveries, such as those enabling rogue actions or sensitive data exfiltration. For example, a report detailing a security bug that could trigger unauthorized actions in a flagship product can earn up to $20,000, while sensitive data exfiltration bugs can net $15,000. Lower-tier rewards are available for issues like phishing enablement, model theft, context manipulation, access control bypass, unauthorized product usage, and cross-user denial of service. Google’s security engineering managers highlighted that the new program is an extension of the existing Abuse Vulnerability Reward Program, but with a dedicated focus on AI-related threats. Since 2023, when Google first expanded its bug bounty scope to include AI, researchers have already earned over $430,000 for AI-related findings. The company hopes that a standalone program will clarify the types of AI vulnerabilities in scope and encourage more targeted research. Acceptable reports include attacks that modify accounts or data, indirect prompt injections, phishing vectors, model theft, and persistent manipulation of AI environments. The program also addresses past confusion about what constitutes an in-scope AI bug, providing clearer guidelines for researchers. Google’s move comes as the company continues to integrate AI into more of its products, increasing the potential attack surface. The program is part of a broader effort to proactively secure AI systems and maintain user trust as AI adoption accelerates. By offering substantial financial incentives, Google aims to attract top security talent to help identify and mitigate emerging AI threats before they can be exploited in the wild. The launch of the AI VRP underscores the growing importance of AI security in the tech industry and sets a precedent for other companies to follow. Researchers interested in participating are encouraged to review the detailed reward tiers and submission guidelines provided by Google. The company has also committed to sharing lessons learned from the program to further strengthen the security of AI systems industry-wide.
Jun 29, 2026
Bug bounty programs have significantly enhanced software security by leveraging a global network of ethical hackers to identify vulnerabilities that internal teams may overlook. Organizations have benefited from cost-effective, continuous security testing, with real-world examples showing that even critical flaws missed by experienced engineers can be discovered by external researchers, sometimes preventing losses in the millions. The diversity and scale of the bug bounty community have enabled companies to access a wide range of skills and perspectives, making digital systems safer and more resilient. However, the operational complexity of managing bug bounty programs has led to new challenges. The rise of bug bounty platforms as intermediaries was intended to filter out noise and streamline vulnerability management, but these platforms now struggle with overwhelming volumes of low-quality, duplicate, and AI-generated reports. The triage process has become bogged down by administrative burdens, reducing the effectiveness of these platforms and prompting a shift toward more targeted, expert-driven security testing as part of continuous offensive security programs. Organizations are increasingly seeking solutions that prioritize actionable risk reduction over sheer volume of findings.
Jul 12, 2026
AI-assisted vulnerability discovery is driving a sharp rise in open source security findings, straining the systems used to validate, disclose, and remediate flaws. Chainguard said its Athena coalition has already processed more than **20,000** AI-generated findings and helped produce over **2,000 patches** across **500 projects**, while Anthropic previously estimated its tooling uncovered **6,202** high- or critical-severity issues in more than 1,000 open source projects. The Linux Foundation has also launched **Akrites**, a coalition with a shared incident response capability and standardized coordinated disclosure process to help the ecosystem manage AI-enabled vulnerability discovery. GitHub said the resulting volume has pushed its Advisory Database to record levels, with **1,560** reviewed advisories published in May 2026 and more than **6,000** advisory decisions processed per month from March through May, yet incoming private reports, repository advisories, and CVE requests still outpaced review capacity. The company said reviewed advisories remain human-validated and Dependabot alerts continue to function normally, but publication timelines for many new advisories have stretched from roughly a week to several weeks as analysts handle package disambiguation, version-range reconstruction, multi-ecosystem verification, and conflicting upstream data; GitHub is responding with improved triage, expanded backend capacity, automation, AI-assisted research tools, and guidance for researchers to submit more complete reports and request CVEs only when publication is intended.
Jul 12, 2026