Microsoft Paid Over $20 Million in Bug Bounties to 562 Researchers in Past Year

Record Bug Bounty Payouts

Microsoft reported paying out over $20 million through its bug bounty programs between July 1, 2025, and June 30, 2026. This amount was distributed among 562 researchers who submitted 2,531 eligible vulnerability reports across 15 programs.

The total includes $2.3 million from the Zero Day Quest hacking contest and $800,000 for new initiatives targeting third-party and open-source code vulnerabilities. The largest individual payout reached $200,000.

Increased Engagement and AI Impact

The company noted a significant increase in submission volume during the latter half of the year. Microsoft attributes this rise to strong engagement from the research community and the growing use of AI to support security research.

This year's payout of over $20 million surpasses previous years, with approximately $17 million paid in 2024-2025 and around $13 million annually between 2020 and 2023.

Researcher Dissatisfaction

Despite the increased payouts, some researchers have expressed dissatisfaction with Microsoft's handling of vulnerability reports. One researcher, known as Chaotic Eclipse, publicly released details of several zero-day vulnerabilities without prior patching by Microsoft, some of which were subsequently exploited.

Chaotic Eclipse has accused Microsoft of mishandling reports, ignoring communications, withholding bounty payments, deleting their reporting account, and breaching a prior agreement.