Loading story…
Intel has suspended its paid vulnerability-reward program on Intigriti, which had accepted findings affecting its hardware, software, firmware, open-source projects, and later web services. The program offered rewards ranging from $500 to $100,000; its public bounty page remains online but is marked as suspended.
Researchers may still report vulnerabilities through a replacement responsible-disclosure program on Intigriti, but the new process provides no monetary rewards. Intel has not publicly explained the change. While AI-generated and duplicate reports have burdened disclosure programs elsewhere, there is no evidence that they caused Intel's decision; an earlier Intigriti update said the company was evaluating enhanced bounty and bonus criteria.
See the reporting duties and controls this puts on the clock.
7 events from the most recent confirmed update back to the earliest known activity.
Intel launched an Intigriti responsible-disclosure program through which researchers can continue submitting vulnerability reports, but the replacement program provides no monetary bounties.
Intel suspended its Intigriti-hosted paid bug bounty program, whose awards had ranged from $500 to $100,000 and covered hardware, software, firmware, and open-source projects. The bounty board remained accessible but was marked as suspended, and Intel gave no public explanation for ending paid rewards.
Intel expanded its bounty program's eligible scope to include web services during the period from mid-2025 through October 2025.
Intel said that 105 of the 231 CVEs it addressed during 2020 had been submitted through its bug bounty program.
Intel expanded access to its bug bounty program, opening submissions to all researchers.
Intel launched its bug bounty program as an invite-only initiative for security researchers.
In an Intigriti update, Intel said it was evaluating enhanced bounty and bonus criteria.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitHub has overhauled its bug bounty program, reducing public-program payouts, replacing variable reward ranges with fixed amounts by severity, and creating a permanent invite-only VIP tier for researchers who consistently deliver high-impact findings. The company said the changes are intended to reduce triage pressure, improve researcher experience, and strengthen collaboration with trusted contributors, with the new structure applying to reports submitted on or after July 27, 2026. Under the revised model, top rewards are being concentrated in the VIP program, which offers higher payouts, faster engagement, and closer access to GitHub’s security engineering team, while public submissions will face stricter quality controls. GitHub is also requiring stronger HackerOne signal from participants to curb low-effort and AI-generated reports, reflecting broader industry concern that automated and commoditized vulnerability discovery is increasing report volume while making validated, product-specific findings more valuable.
Jul 25, 2026
AMD fixed a **critical remote code execution** weakness in its auto-updater software after researcher Paul reported that downloads were being fetched over insecure HTTP, creating a man-in-the-middle path to deliver malicious code. The company took **124 days** to ship a fix because multiple tools required coordinated updates, and the researcher later confirmed the software now retrieves drivers more securely. Reporting also noted lingering concerns about implementation details, including continued reliance on `CRC32` for file validation, and claims from a Reddit user that the vulnerable updater path may not have been actively used, potentially requiring users to download a fresh version of AMD’s software to receive the remediation. The dispute escalated after AMD allegedly refused to pay an expected **$10,000** bug bounty, arguing that man-in-the-middle attacks were outside the scope of its program despite earlier indications that it would issue a CVE, credit the researcher, and address the flaw. Security community criticism intensified further after AMD was reported to have changed its disclosure and bounty rules to require non-disclosure even for findings deemed out of scope, a move critics said could discourage transparency and weaken incentives for independent vulnerability research.
Jun 29, 2026
Google has introduced a new bug bounty initiative specifically targeting vulnerabilities in its artificial intelligence (AI) products and services. The program, known as the AI Vulnerability Reward Program (AI VRP), is designed to incentivize security researchers to identify and report security flaws, abuse vectors, and high-impact vulnerabilities within Google’s AI ecosystem. The scope of the program includes flagship AI products such as Google Search, Gemini Apps across web and mobile platforms, and core Google Workspace applications like Gmail, Drive, Meet, and Calendar. Additional in-scope products include AI Studio, Jules, and other AI integrations within Google’s suite. Rewards for valid vulnerability reports range from $500 to $30,000, with the highest payouts reserved for novel, high-impact discoveries, such as those enabling rogue actions or sensitive data exfiltration. For example, a report detailing a security bug that could trigger unauthorized actions in a flagship product can earn up to $20,000, while sensitive data exfiltration bugs can net $15,000. Lower-tier rewards are available for issues like phishing enablement, model theft, context manipulation, access control bypass, unauthorized product usage, and cross-user denial of service. Google’s security engineering managers highlighted that the new program is an extension of the existing Abuse Vulnerability Reward Program, but with a dedicated focus on AI-related threats. Since 2023, when Google first expanded its bug bounty scope to include AI, researchers have already earned over $430,000 for AI-related findings. The company hopes that a standalone program will clarify the types of AI vulnerabilities in scope and encourage more targeted research. Acceptable reports include attacks that modify accounts or data, indirect prompt injections, phishing vectors, model theft, and persistent manipulation of AI environments. The program also addresses past confusion about what constitutes an in-scope AI bug, providing clearer guidelines for researchers. Google’s move comes as the company continues to integrate AI into more of its products, increasing the potential attack surface. The program is part of a broader effort to proactively secure AI systems and maintain user trust as AI adoption accelerates. By offering substantial financial incentives, Google aims to attract top security talent to help identify and mitigate emerging AI threats before they can be exploited in the wild. The launch of the AI VRP underscores the growing importance of AI security in the tech industry and sets a precedent for other companies to follow. Researchers interested in participating are encouraged to review the detailed reward tiers and submission guidelines provided by Google. The company has also committed to sharing lessons learned from the program to further strengthen the security of AI systems industry-wide.
Jun 29, 2026