bug bounty

in English: bug bounty program

basicwidespread

A program where a company or organization pays a monetary reward to external experts if they find and responsibly report security flaws in its systems.

In plain terms

Imagine a lockmaker displaying their latest lock in the main square and saying: anyone who can open it without a key and show how they did it will get paid. Bug bounty is the same for software: a company publicly announces it will pay for security vulnerabilities if the finder reports them to the company rather than to criminals.

The company finds this worthwhile because its own testers do not find everything, while thousands of external eyes notice things they overlooked. Moreover, it pays only for actual findings, not for the time spent searching. For the researcher, it is a legal and respected way to monetize their knowledge.

In the AI era, the concept has expanded. Large model developers now pay rewards not only for classic software bugs but also when someone can get the model or an AI agent to do something it should not. Examples include leaking data or bypassing its safety safeguards. Rules vary by company: in many programs a simple, one-off jailbreak earns no reward, only severe or generally working methods do.

How it works

The company publishes the rules: which systems may be tested, which methods are prohibited, and how large a reward each type of bug earns.
The researcher searches for errors within the rules and, if found, submits a detailed, reproducible description, typically via an intermediary platform (such as HackerOne or Bugcrowd).
The company's security team reviews the report: whether the bug is real, how severe it is, and whether someone else has already reported it.
If the bug is valid, the company fixes it and the researcher receives a reward proportional to the severity. For minor bugs, this amounts to tens of thousands of forints; for the most severe cases at the largest companies, it can reach hundreds of millions of forints.
After a fix, the details of the error are often made public jointly so that others can learn from it.

An everyday example

Your phone's banking app requests an update, stating only "security fixes" in the description. It is possible that an independent researcher found the bug, reported it through the bank's or the app developer's bug bounty program, and received a reward before anyone could exploit it.

Who is affected

everyoneThe applications and AI services you use are partly more secure because external researchers find vulnerabilities in them before fraudsters do.

developerYou may receive a report about your code or agent that you need to assess and fix quickly, and if you understand security, you can also hunt for vulnerabilities yourself. → Code

entrepreneur, executiveA relatively cheap way to strengthen security, but it only works if you have the capacity to process reports and fix errors.

jobseeker, new graduateSuccessful reports provide a public, verifiable reference that can serve as an entry point into the cybersecurity profession. → Work & HR

A common misconception

MythIf a company has a bug bounty program, you can freely hack any of its systems and even get paid for it.

In realityOnly the systems announced as in scope can be tested, under the published rules. Anyone who goes beyond these limits or takes data away can commit a crime just like any other attacker.

Limits and risks

The program does not replace the company's own security work: nothing guarantees that researchers will examine every system and find every bug.
If you examine a company's system that lacks such a program, you assume legal risk: in Hungary, unauthorized intrusion can constitute a criminal offense, and good intentions alone do not exempt you.
The reward is uncertain: if someone else already reported the bug or the company does not consider it serious enough, you get nothing for days of work.
Fake or worthless reports mass-produced with AI are flooding the programs, which slows down the processing of real bugs.

Similar, but not the same

penetration test – Penetration tests are conducted by commissioned experts for a pre-agreed fee and deadline. Bug bounty, however, is continuous, open to many independent researchers (though there are also invitation-only programs), and pays only for findings.
red teaming – Red teaming is a targeted, organized attack simulation with a designated team, while bug bounty is a continuous, open call for independent researchers.
responsible disclosure – Responsible vulnerability disclosure only regulates how to safely report a bug; a monetary reward is not necessarily given for it.

Related concepts

Broader

cybersecurity, AI safety, vulnerability management

Narrower

AI bug bounty, model security bug bounty program

On the edge

red teaming, penetration test, etikus hekker, prompt injection, jailbreak

A brief history

The first program, announced under the name 'bug bounty', was launched by Netscape in 1995 for the Navigator browser. In the 2010s, major technology companies and intermediary platforms made it standard practice, and by the mid-2020s, AI developers had also adopted it.

Where things stand

As of late 2026, it is established practice at major technology companies and, increasingly, at public bodies, and leading AI developers run a separate program for flaws in models and agents. A new development is that AI agents are now hunting for flaws too, which raises both the number of valid findings and the number of false reports.

Status: 2026 November

In the news

Appears in 9 Agent Age stories; the curve shows weekly occurrence in the news magazine.

Survey: 67% of developers use AI for code generation, 61% for debugging, only 20% in productionNov 7, 2026 · Code
Survey: AI-generated code shifts the bottleneck to debugging, slowing releasesOct 7, 2026 · Code
Google suspends open-source bug bounty programme after flood of AI-generated reportsOct 5, 2026 · Code
Google freezes open-source bug bounty program amid flood of invalid AI submissionsOct 3, 2026 · Code
Undo research: AI agents push debugging to 42% of the workweekSep 29, 2026 · Code
LLM-written PhantomRaven malware steals npm and GitHub credentialsSep 15, 2026 · Code
MCP ecosystem expands with Docker catalog, Rocket.Chat server and Chrome DevTools, while security lagsAug 31, 2026 · Code
Open-source projects ban or restrict AI-generated code: OpenJDK, Rust, curlAug 10, 2026 · Code

Also known as

bug bounty · bug bounty program · bug-hunting program · debugging · bug bounty program · Vulnerability bounty program · vulnerability reward program · VRP

Sources

Wikipedia: Bug bounty program

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.