AI helps Microsoft bug hunters chase a record $20M payday

www.theregister.com · 2026-08-05 · by Long Nguyen ·generic
Broader bounty rules added to a swelling volume of machine-assisted vulnerability reports

AI helps Microsoft bug hunters chase a record $20M payday

Microsoft announced this week that between July 1, 2025, and June 30, 2026, the company had paid more than $20 million in bug bounties to 562 researchers.

The total was a Redmond record, as was the number of those submitting bug reports – despite having to navigate a sometimes frustrating submissions process.

For comparison, the previous year's program, which itself set a new company record, paid 344 researchers around $17 million.

REG AD

You could argue that the numbers do not represent a fair fight, however. Microsoft expanded its bug bounty program in December 2025, changing reports to what it calls "In Scope By Default."

REG AD

Under the policy, critical vulnerabilities became eligible for rewards if they had a direct and demonstrable impact on Microsoft's online services, even when the faulty code belonged to a third party or an open source project.

In short, Microsoft had opened the door to paying out a shedload more each year.

Microsoft introduced the policy roughly halfway through the bounty year and said it accounted for $800,000 in rewards that would not previously have been available.

Another $2.3 million was awarded through Zero Day Quest, Microsoft's security research challenge and live hacking event.

The increased number of reports this year can also be partially explained by the noticeable influx of submissions during the second half of the year, Microsoft said, which the company attributed in part to "the growing use of AI to support security research."

Microsoft has also attributed its increasingly crowded Patch Tuesdays partly to its own use of advanced AI models for vulnerability discovery.

July's 622 vulnerabilities pummeled the previous record of 206, set only a month earlier. June had itself surpassed April's 165, which at the time was Microsoft's second-biggest Patch Tuesday ever, and May's 137.

Days before the record-breaking July Patch Tuesday, Microsoft's Windows + Devices veep warned customers to expect more of the same now that AI plays a big part in vulnerability discovery, both inside Microsoft and by external bounty hunters.

REG AD

However, Microsoft Executive VP of Windows + Devices Pavan Davuluri was quick to point out that the company offers customers a suite of automated patching tools to ease the burden, but didn't mention anything about tools to fix the machines its Windows updates so often borks, like Intel-based Dells.

MORE CONTEXT

www.theregister.com · 10 images · 137 links

Comments (0)

No comments yet