GitHub slashes public bug bounty payouts as AI report flood buries its security team
GitHub has decided that, if everyone with an AI chatbot can file a bug bounty report, it may as well stop paying them like seasoned security researchers.
Starting July 27, the Microsoft-owned code forge is overhauling its bug bounty program with a two-tier system that cuts rewards for public submissions while dangling much fatter payouts to a new invite-only group of researchers with proven track records.
At the same time, newcomers will find themselves capped on how many reports they can submit until they've demonstrated they can produce something worth reading.
REG AD
The Microsoft-owned biz says that the shake-up is a response to the flood of low-effort and AI-generated reports now accompanying many bug bounty programs. Rather than paying more people to file more reports, GitHub wants to spend more on researchers who've proved they can find the real thing. Cathering Cassell, product security engineer at GitHub. “These changes are about two things: reducing the noise so we can focus on the signal, and building a program that serious researchers find rewarding to participate in.”
REG AD
For researchers sticking with the public program, a low-severity finding that previously earned between $500 and $1,000 will now bring in $250. Medium bugs top out at $2,000 instead of $5,000, high-severity flaws have been cut from as much as $20,000 to $5,000, and the maximum reward for a critical vulnerability falls from $30,000 to $10,000.
MORE CONTEXT
- GitHub ponders kill switch for pull requests to stop AI slop
- GitHub cuts short offer to burn repos on CD after mockery ensues
- Disgruntled 0-day hunter 'humiliated' by Microsoft pledges 'bone shattering drop' as Redmond calls cops
- Holy git! Microsoft code-sharing site suffers downtime, despite move to Azure
-
columnists Airbus takes flight from AWS. What happens next is critical
-
off-prem Anyone with a shed, an extension cord, a couple of GPUs and an overdraft is building datacenters. Fujitsu just offloaded five
-
security Linux kernel team publishes 432 CVEs in two days
-
AI AND ML OpenAI admits it was the source of the agent swarm that attacked Hugging Face
-
off-prem AWS customer learns the hard way how even the smallest oversight can be mission-critical - AI and ML Codeberg gives vibe-coded projects the toss, promotes human FLOSS AI no longer welcome in human-focused community
- Systems AMD attacks the rack with Helios systems that rival Nvidia's Spec for spec, the House of Zen's first rack-scale AI compute platform is bigger and faster than Nvidia's Vera Rubin by nearly every metric, but that's only on paper
- DEVOPS Model Context Protocol prepares to break with its stateful past Biggest overhaul since launch ditches sessions, guts little-used features, and leaves homebrew implementations facing a slog
- Offbeat Tesla burns through a billion as Musk bets the farm on chips and bots Optimus remains 'very complex' and Robotaxis will try not to flatten your cat
- software IBM insists AI didn't kill software deals, just delayed them Big Blue says customers postponed rather than abandoned major purchases as hardware soaked up enterprise budgets
- Security Russians are posing as Signal support to launch phishing attacks PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!
- Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more
- Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructure Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included
- Security EQT buys majority share in Swiss cybersecurity biz Acronis Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified
- Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight On the plus side, infosec's a good bet for a long, stable career
- GNOME can look like Windows – and Flashback can do it without extensions New 'Simple-taskbar' is an option, but there's a simpler, stabler way
- A moment of silence, please, for the final release of Debian on x86-32 New Debian versions hit FOSSland in the form of 13.6 and 12.15
- Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websites Flaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide
- Frame: A new X11 server – implemented directly in assembly Joins yserver, Phoenix, and of course XLibre – and outlier Arcan
- Cinnamon 6.8 will support Wayland – if you want it Next version of Linux Mint’s desktop has both kinds of display server
- KDE Plasma users face a dire omen of change: 6.6.6 arrives 6.7 is now current, and in 6.8 you're getting Wayland whether you like it or not
The highest rewards are now reserved for GitHub's new invite-only VIP program. There, low-severity findings are worth $1,000, medium bugs $7,500, high-severity issues $20,000, and critical vulnerabilities at least $30,000.
Entry isn't open to everyone. GitHub says invitations will be based on a proven history of valid reports, with researchers needing anything from one accepted critical vuln to seven accepted low-severity findings to qualify.
GitHubb is also enabling HackerOne's "signal requirement," limiting how many reports new researchers can submit before they've established a history of legitimate findings. It says genuine newcomers will still have up to four opportunities to prove themselves, while reports already sitting in the backlog will continue to be assessed under the previous payout structure.
The overhaul follows changes GitHub introduced earlier this year that tightened report-quality requirements and warned researchers against flooding the platform with AI-assisted submissions.
GitHub is betting that fewer reports, from researchers with a proven track record, will do more for security than an ever-growing pile of AI-assisted submissions waiting for someone to read them. ®
[](https://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.theregister.com%2Fdevops%2F2026%2F07%2F23%2Fgithub-slashes-public-bug-bounty-payouts-as-ai-report-flood-buries-its-security-team%2F5277046) [](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.theregister.com%2Fdevops%2F2026%2F07%2F23%2Fgithub-slashes-public-bug-bounty-payouts-as-ai-report-flood-buries-its-security-team%2F5277046) [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.theregister.com%2Fdevops%2F2026%2F07%2F23%2Fgithub-slashes-public-bug-bounty-payouts-as-ai-report-flood-buries-its-security-team%2F5277046) [](https://bsky.app/intent/compose?text=GitHub%20slashes%20public%20bug%20bounty%20payouts%20as%20AI%20report%20flood%20buries%20its%20security%20team%0Ahttps%3A%2F%2Fwww.theregister.com%2Fdevops%2F2026%2F07%2F23%2Fgithub-slashes-public-bug-bounty-payouts-as-ai-report-flood-buries-its-security-team%2F5277046) [](https://www.reddit.com/submit?url=https%3A%2F%2Fwww.theregister.com%2Fdevops%2F2026%2F07%2F23%2Fgithub-slashes-public-bug-bounty-payouts-as-ai-report-flood-buries-its-security-team%2F5277046&title=GitHub%20slashes%20public%20bug%20bounty%20payouts%20as%20AI%20report%20flood%20buries%20its%20security%20team) [](https://api.whatsapp.com/send?text=GitHub%20slashes%20public%20bug%20bounty%20payouts%20as%20AI%20report%20flood%20buries%20its%20security%20team%0Ahttps%3A%2F%2Fwww.theregister.com%2Fdevops%2F2026%2F07%2F23%2Fgithub-slashes-public-bug-bounty-payouts-as-ai-report-flood-buries-its-security-team%2F5277046)
REG AD
Patches Year-long Russian attacks infect users as soon as they look at an email Phishing for dummies