Loading story…
Intel has suspended its paid bug-bounty program, which previously offered researchers $500 to $100,000 for valid vulnerability reports. The company’s Intigriti listing now operates as a responsible-disclosure channel without monetary rewards: researchers can continue reporting flaws, but Intel will not pay bounties. Intel has not publicly stated why it made the change.
Intel’s public information is inconsistent: a legacy bounty page remains online and marked as suspended, while other material still advertises financial rewards. The suspension follows wider pressure on vulnerability-reporting programs from duplicate and AI-generated submissions, affecting projects and services including the Linux kernel, curl, and HackerOne’s Internet Bug Bounty; however, no evidence links those issues to Intel’s decision.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
Linus Torvalds said that duplicate AI-generated reports had made the Linux kernel security mailing list nearly unmanageable.
Bug-bounty participants identified 105 of the 231 vulnerabilities Intel fixed during the year.
One year after launching the invitation-only program, Intel opened its bug-bounty program to all security researchers.
Intel launched its vulnerability-reward program, initially operating it on an invitation-only basis.
Intel suspended its paid bug-bounty program and changed its Intigriti listing to a no-bounty responsible-disclosure program. Researchers may continue reporting vulnerabilities, but Intel did not publicly explain why monetary rewards were suspended.
HackerOne paused acceptance of new submissions to its Internet Bug Bounty program, citing increased AI-assisted vulnerability discoveries.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Intel has suspended its paid vulnerability-reward program on Intigriti, which had accepted findings affecting its hardware, software, firmware, open-source projects, and later web services. The program offered rewards ranging from $500 to $100,000; its public bounty page remains online but is marked as suspended. Researchers may still report vulnerabilities through a replacement responsible-disclosure program on Intigriti, but the new process provides no monetary rewards. Intel has not publicly explained the change. While AI-generated and duplicate reports have burdened disclosure programs elsewhere, there is no evidence that they caused Intel's decision; an earlier Intigriti update said the company was evaluating enhanced bounty and bonus criteria.
Sep 19, 2026
GitHub has overhauled its bug bounty program, reducing public-program payouts, replacing variable reward ranges with fixed amounts by severity, and creating a permanent invite-only VIP tier for researchers who consistently deliver high-impact findings. The company said the changes are intended to reduce triage pressure, improve researcher experience, and strengthen collaboration with trusted contributors, with the new structure applying to reports submitted on or after July 27, 2026. Under the revised model, top rewards are being concentrated in the VIP program, which offers higher payouts, faster engagement, and closer access to GitHub’s security engineering team, while public submissions will face stricter quality controls. GitHub is also requiring stronger HackerOne signal from participants to curb low-effort and AI-generated reports, reflecting broader industry concern that automated and commoditized vulnerability discovery is increasing report volume while making validated, product-specific findings more valuable.
Jul 25, 2026
The *cURL* project ended its bug bounty program after maintainers reported being overwhelmed by a surge of low-quality, often AI-generated submissions that consumed significant triage time without yielding actionable security findings. cURL maintainer **Daniel Stenberg** documented the decision in a GitHub change (`BUG-BOUNTY.md`) indicating the bounty would stop at the end of January 2026, citing the “torrent” of submissions and the operational burden placed on the project’s security team. Stenberg said recent bounty activity included multiple submissions that required substantial effort to assess yet did not describe actual vulnerabilities, and he expressed hope that removing financial incentives would reduce “crap and non-well researched reports,” whether AI-generated or not. While acknowledging that AI can sometimes assist in finding legitimate bugs, he encouraged researchers to continue reporting **real security vulnerabilities** even without payment, noting that the impact of ending the bounty on future reporting quality remains to be seen.
Jun 29, 2026