Intel Shuts Down Its Bug Bounty Program

Intel appears to have wound down its paid vulnerability-hunting program. This week, as one Phoronix reader noticed, the former bug bounty was suspended and replaced by a new program — but one that offers no monetary rewards for the bugs it finds.

What changed

Intel ran its program on Intigriti, and it covered a broad range of the company's products: hardware, software, firmware, and Intel's open-source projects. Payouts under the old scheme ranged from $500 to $100,000 depending on the severity of the finding.

Now the program's page on Intigriti — the very one linked from Intel's security pages — is marked as "suspended." A significant chunk of the previous information about its terms has vanished along with it; anyone interested can dig it up in the Wayback Machine.

The new program, launched a day earlier, is stated in no uncertain terms: "This is a non-rewarded responsible disclosure program." In other words, you can still report vulnerabilities, but Intel no longer intends to pay for them.

No official reason given

The company offered no official explanation. The author of the write-up, however, suggests a connection to the broader context: software across the industry is currently being swamped by a wave of bug reports generated by AI and large language models. The Linux kernel and other open-source projects are already suffering from a flood of such reports of imaginary vulnerabilities, and it would be no surprise if this very factor influenced Intel's decision.

The logic is clear enough: monetary rewards become bait for those who mass-produce plausible but hollow reports with the help of AI. By removing the payouts, the company strips such activity of its incentive — at the cost of also leaving legitimate researchers without a financial motive.

Source: Phoronix