Intel suspends bug bounty program, replaces it with unrewarded disclosure program

Intel's Bug Bounty Program Suspended

Intel has suspended its bug bounty program, which previously offered financial rewards for vulnerability disclosures. The program, which launched in 2017 and became open to all researchers in 2018, covered software, hardware, firmware, and open-source projects. Rewards ranged from $500 to $100,000 depending on the quality and severity of the report.

Replacement Program Offers No Rewards

The company has replaced the bounty program with a 'responsible disclosure program without bounties' on the Intigriti platform. No official reason was provided for this change. Intel's website still details the old bounty structure, but the Intigriti site confirms the program's suspension and lack of rewards.

Impact on Vulnerability Discovery

The previous bounty program was a significant source of vulnerability reports for Intel; 105 out of 231 CVEs addressed by Intel in 2020 originated from the program. The removal of financial incentives may reduce the number of external security researchers reporting flaws to Intel, potentially affecting the company's ability to identify and patch vulnerabilities.

Industry Context

This move by Intel follows a trend seen in other projects. The Linux kernel has experienced a significant increase in security reports, with maintainers becoming overwhelmed, partly due to AI-generated reports. Linus Torvalds noted that duplicate AI reports are 'almost entirely unmanageable.' Similarly, Curl closed its bounty program due to a flood of AI-generated submissions. HackerOne's Internet Bug Bounty program also paused submissions, citing the expansion of AI-assisted vulnerability discovery.