Microsoft Paid a Record $20 Million in Bug Bounties, Helped by AI-Assisted Research

Microsoft paid more than $20 million in bug bounties to 562 security researchers between July 1, 2025, and June 30, 2026, a company record for both the payout and the number of people paid. The Register reported the totals after Microsoft announced them this week. The previous year, itself a record, paid about $17 million to 344 researchers.

Part of the jump comes from wider rules. In December 2025 Microsoft moved to what it calls “In Scope By Default,” which makes critical vulnerabilities eligible for rewards when they have a direct and demonstrable impact on its online services, even if the faulty code belongs to a third party or an open source project. Microsoft said that change, made about halfway through the bounty year, accounted for $800,000 in rewards that wouldn’t have been available before. Another $2.3 million went out through Zero Day Quest, its research challenge and live hacking event.

The rest of the increase came from a surge of reports in the second half of the year, which Microsoft attributed in part to “the growing use of AI to support security research.” Because the pool of researchers grew faster than the total, the average payout fell, from roughly $49,000 per researcher to about $35,600.

Bigger Patch Tuesdays

Microsoft’s own AI-assisted bug hunting is also filling its monthly updates. July’s Patch Tuesday fixed at least 570 flaws, according to Krebs on Security and TechCrunch, almost triple June’s record. The Register puts July’s total at 622, against 206 in June, 165 in April and 137 in May.

Days before the July release, Pavan Davuluri, executive vice president of Windows and Devices, told customers to expect more. “The pace of vulnerability discovery is changing with advances in AI making it possible to find more issues, faster, across more code, with new mechanisms that can accelerate both discovery and analysis,” he wrote in a Windows Experience Blog post. He pointed admins to tools such as Windows Autopatch with hotpatch in Intune to help keep up with the larger update volume.

The year also brought friction. A researcher using the name NightmareEclipse published a series of Windows zero-days outside coordinated disclosure after complaining about how Microsoft handled earlier reports, and Microsoft responded by threatening to involve its Digital Crimes Unit, The Register noted.