Tag: bug-bounty
-
OpenAI Compaction Flaw Exposed AI Reasoning to Researchers
Researchers uncovered an OpenAI API flaw that exposed hidden AI reasoning traces, prompting a fix and a $6000 bug bounty reward First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/openai-compaction-flaw-ai/
-
Microsoft Introduces New Bug Bounty Rules That Could Affect Security Researchers’ Rewards
Microsoft has introduced new rules for assessing reports in its bug bounty programs, tying submission completeness more directly to potential rewards. Announced by the Microsoft Security Response Center (MSRC) on October 20, 2026, these changes replace the previous multiple report quality levels with two assessments: >>Complete<>Not Complete.<< This updated approach establishes clearer expectations […] The…
-
12 Best Bug Bounty Platforms Compared (2026): Features Pricing
HackerOne and Bugcrowd remain the global anchors, Intigriti and YesWeHack lead the European lane, and Synack’s vetted red team defines the private high-assurance end. Twelve platforms compared across crowd models, triage quality, and jurisdiction with the specialty lanes (web3’s Immunefi, Cobalt’s PtaaS) and status flags treated honestly. Quick Verdict: Best Bug Bounty at a Glance…
-
Google quadruples Chrome bug bounty base pay, offers up to $20,000 for sandbox escapes
Google is updating its Chrome Vulnerability Rewards Program (Chrome VRP), increasing payments for memory corruption vulnerabilities and expanding rewards for other security … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/14/google-chrome-vulnerability-rewards-program-updates/
-
AI slop overwhelms Google’s OSS bug bounty programme
Google has closed its open source vulnerability reporting programme to new submissions while it recalibrates in the face of a surge in automated junk reports. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366651792/AI-slop-overwhelms-Googles-OSS-bug-bounty-programme
-
AI slop overwhelms Google’s OSS bug bounty programme
Google has closed its open source vulnerability reporting programme to new submissions while it recalibrates in the face of a surge in automated junk reports. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366651792/AI-slop-overwhelms-Googles-OSS-bug-bounty-programme
-
Google Pauses Open-Source Bug Bounty Program Amid AI Slop
Tech Giant Cites ‘Significant Rise in Automated Submissions’ Lacking Validity. Google has indefinitely paused a bug bounty program designed to reward researchers who find flaws in the open-source software it maintains, citing a significant rise in automated submissions, the vast majority of which are not valid. Other software maintainers report similar struggles. First seen on…
-
Bug-Bounty-Programm: Zu viele falsche KI-Meldungen für Google
Viele automatisierte Fehlermeldungen sind unbrauchbar. Google nimmt deshalb vorerst keine neuen Open-Source-Berichte mehr an. First seen on golem.de Jump to article: www.golem.de/news/ungueltige-ki-einreichungen-google-stoppt-bug-bounty-programm-fuer-open-source-2610-213721.html
-
Bug-Bounty-Programm: Zu viele falsche KI-Meldungen für Google
Viele automatisierte Fehlermeldungen sind unbrauchbar. Google nimmt deshalb vorerst keine neuen Open-Source-Berichte mehr an. First seen on golem.de Jump to article: www.golem.de/news/ungueltige-ki-einreichungen-google-stoppt-bug-bounty-programm-fuer-open-source-2610-213721.html
-
Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports
Google has stopped accepting product vulnerability reports through its bug bounty program for its open-source software.The change, in effect since October 1, means researchers can no longer submit security flaws in the code of projects such as Go, Angular, and Protocol Buffers there for a reward. Reports about supply chain compromises are still accepted, and…
-
Ungültige KI-Einreichungen: Google stoppt Bug-Bounty-Programm für Open Source
Die überwiegende Mehrheit der automatisiert eingereichten Fehlermeldungen ist ungültig. Google überarbeitet nun seine Regeln für KI-basierte Einreichungen. First seen on golem.de Jump to article: www.golem.de/news/ungueltige-ki-einreichungen-google-stoppt-bug-bounty-programm-fuer-open-source-2610-213721.html
-
Google Tightens Open-Source Bug Bounty Rules After Surge in AI-Generated Vulnerability Reports
Google has stopped accepting new >>product vulnerability<< reports through its Open Source Software Vulnerability Reward Program (OSS VRP) due to a significant increase in automated submissions that are predominantly invalid. This restriction took effect on October 1, 2026, and Google plans to provide an update regarding this part of the program in the first quarter…
-
Google Suspends Open-Source Bug Bounty Due to AI Vulnerability Reports
Google has paused its Open Source Vulnerability Rewards Program due to a flood of AI submissions First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/google-suspends-opensource-bug/
-
Google Suspends Open Source Bug Bounty Over AI-Generated Reports
Google has suspended its Open Source Software Vulnerability Rewards Program (OSS VRP), a vulnerability search initiative that paid researchers for finding flaws in the company’s open-source software. The pause took effect on October 1, 2026. Google blamed a “significant rise” in automated and AI-generated reports, most of which turned out to be invalid. First seen…
-
AI slop submissions force Google to freeze its open-source bug bounty
Google has stopped accepting new product vulnerability reports through its Open Source Software Vulnerability Reward Program (OSS VRP), after a wave of invalid, AI-generated … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/05/google-ai-generated-vulnerability-reports-pause/
-
Google halts open-source bug bounty program amid AI spam surge
Google has now suspended submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) after being flooded by AI-generated reports. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/google/google-halts-open-source-bug-bounty-program-amid-ai-spam-surge/
-
Google froze its open source bug bounty program due to a ‘significant rise’ in AI submissions
AI slop seems to be overwhelming bug bounty programs. First seen on techcrunch.com Jump to article: techcrunch.com/2026/10/04/google-froze-its-open-source-bug-bounty-program-due-to-a-significant-rise-in-ai-submissions/
-
100.000 Dollar gestrichen Update – – Intel ‘pausiert” Bug-Bounty-Prämien
Intel hat sein bisheriges Bug-Bounty-Programm eventuell ausgesetzt. Das neue Meldeprogramm lockt Sicherheitsforscher nicht mehr mit Geld. First seen on computerbase.de Jump to article: www.computerbase.de/news/wirtschaft/100-000-dollar-gestrichen-intel-stoppt-moeglicherweise-bug-bounty-praemien.99474
-
100.000 Dollar gestrichen Update – – Intel stoppt offenbar Bug-Bounty-Prämien
Intel hat sein bisheriges Bug-Bounty-Programm eventuell ausgesetzt. Das neue Meldeprogramm lockt Sicherheitsforscher nicht mehr mit Geld. First seen on computerbase.de Jump to article: www.computerbase.de/news/wirtschaft/100-000-dollar-gestrichen-intel-stoppt-moeglicherweise-bug-bounty-praemien.99474
-
Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials
Cybersecurity researchers have disclosed details of a malicious npm package named “tw-pkgprobe-7731” that masquerades as a security tool targeting developers integrating Twilio into their applications, while stealthily attempting to harvest sensitive data.The package, named “tw-pkgprobe-7731,” was first uploaded to the npm registry in mid-August 2026 by an npm account named “twdepprobe7731.” First seen on thehackernews.com…
-
Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials
Cybersecurity researchers have disclosed details of a malicious npm package named “tw-pkgprobe-7731” that masquerades as a security tool targeting developers integrating Twilio into their applications, while stealthily attempting to harvest sensitive data.The package, named “tw-pkgprobe-7731,” was first uploaded to the npm registry in mid-August 2026 by an npm account named “twdepprobe7731.” First seen on thehackernews.com…
-
100.000 Dollar gestrichen – Intel stoppt offenbar Bug-Bounty-Prämien
Tags: bug-bountyIntel hat sein bisheriges Bug-Bounty-Programm eventuell ausgesetzt. Das neue Meldeprogramm lockt Sicherheitsforscher nicht mehr mit Geld. First seen on computerbase.de Jump to article: www.computerbase.de/news/wirtschaft/100-000-dollar-gestrichen-intel-stoppt-moeglicherweise-bug-bounty-praemien.99474
-
100.000 Dollar gestrichen – Intel stoppt möglicherweise Bug-Bounty-Prämien
Tags: bug-bountyIntel hat sein bisheriges Bug-Bounty-Programm eventuell ausgesetzt. Das neue Meldeprogramm lockt Sicherheitsforscher nicht mehr mit Geld. First seen on computerbase.de Jump to article: www.computerbase.de/news/wirtschaft/100-000-dollar-gestrichen-intel-stoppt-moeglicherweise-bug-bounty-praemien.99474
-
100.000 Dollar gestrichen? – Intel stoppt möglicherweise Bug-Bounty-Prämien
Tags: bug-bountyIntel hat sein bisheriges Bug-Bounty-Programm eventuell ausgesetzt. Das neue Meldeprogramm lockt Sicherheitsforscher nicht mehr mit Geld. First seen on computerbase.de Jump to article: www.computerbase.de/news/wirtschaft/100-000-dollar-gestrichen-intel-stoppt-moeglicherweise-bug-bounty-praemien.99474
-
100.000 Dollar gestrichen? – Intel stoppt möglicherweise Bug-Bounty-Prämien
Tags: bug-bountyIntel hat sein bisheriges Bug-Bounty-Programm eventuell ausgesetzt. Das neue Meldeprogramm lockt Sicherheitsforscher nicht mehr mit Geld. First seen on computerbase.de Jump to article: www.computerbase.de/news/wirtschaft/100-000-dollar-gestrichen-intel-stoppt-moeglicherweise-bug-bounty-praemien.99474
-
100.000 Dollar gestrichen? – Intel stoppt möglicherweise Bug-Bounty-Prämien
Tags: bug-bountyIntel hat sein bisheriges Bug-Bounty-Programm eventuell ausgesetzt. Das neue Meldeprogramm lockt Sicherheitsforscher nicht mehr mit Geld. First seen on computerbase.de Jump to article: www.computerbase.de/news/wirtschaft/100-000-dollar-gestrichen-intel-stoppt-moeglicherweise-bug-bounty-praemien.99474
-
Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer
A financially motivated threat actor has been linked to the development and distribution of a JavaScript (JS)-based information stealer known as PhantomRaven via the npm package registry.”The developer likely wrote the malware using a large language model (LLM), an assessment made with high confidence based on verbose comments, placeholder code, and statistical token-analysis patterns,” First…
-
Bug Bounty vs Penetration Testing: What the Data Shows
Key TakeawaysHackerOne’s own data shows the average pentest surfaces 12 vulnerabilities with 16 percent rated high or critical, while bug bounty programs average a higher 25 percent high or critical rate.Pentests tend to surface more systemic and architectural issues, like… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/bug-bounty-vs-penetration-testing-what-the-data-shows/
-
Mythos helps bug bounty firm find critical hidden RCE
HackerOne used Anthropic’s controversial Claude Mythos 5 model on its codebase and found a critical hidden flaw. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366650013/Mythos-helps-bug-bounty-firm-find-critical-hidden-RCE