Intel has suspended its long-standing bug bounty program, which previously offered rewards ranging from $500 to $100,000 per vulnerability. The initiative, which launched in 2017 and opened to all researchers in 2018, covered hardware, software, firmware, and open-source projects. In 2020, the program accounted for 105 of the 231 CVEs addressed by the company.
The former bounty structure categorized vulnerabilities into four tiers, with the highest tier offering payouts between $2,000 and $100,000. Intel recently transitioned to a new disclosure program hosted on the Intigriti platform. Under this new arrangement, researchers can still submit vulnerability reports, but the program currently provides no financial rewards for their findings.
The suspension follows a period of evaluation regarding bounty criteria that began in early 2025. Industry observers suggest that the rise of AI-assisted vulnerability discovery, which has led to a surge in reports for projects like the Linux kernel, may be influencing these policy shifts. Similar trends have been observed elsewhere, with HackerOne pausing its Internet Bug Bounty program in March 2024.
AMD has also suspended its bug bounty program on the Intigriti platform. While the exact reasons for the widespread shift remain under scrutiny, the industry is grappling with the influx of automated security reports. It remains unclear whether Intel’s decision to halt payments is a permanent change or a temporary measure while the company re-evaluates its security research strategy.
