AI Security Intelligence
115 security benchmark scores across 3 benchmarks, each with its source, plus 24 bug bounty programs.
Model Security Leaderboard
Artificial Analysis Cyber Index v1, 0 to 100: defensive security work only, finding, reproducing and patching vulnerabilities in source code. It combines three evaluations AA runs itself on every model, weighted equally: CWE-Bench-AA (Collinear AI), DeepsecBench-AA (Vercel) and CyberGym-E2E-AA (Berkeley RDI). A refused task counts as a failure, and some frontier models refuse most CyberGym tasks, so each row states its refusal rates.
DARPA AI Cyber Challenge (AIxCC)
Official site ↗DARPA's competition for autonomous systems that find and patch vulnerabilities in open-source code with no human intervention. Final results, August 2025.
Notable AI Security Discoveries
All security news →Anthropic launches OSS Scanner, a free opt-in vulnerability scanner for critical open-source projects
Anthropic
Anthropic has launched OSS Scanner, a free, opt-in vulnerability scanner for critical open-source projects. It runs the company's strongest models, including Claude Mythos, against enrolled codebases, and reports go straight to maintainers without human review.
Cognition open-sources Devin plugin with 3 MIT-licensed skills to patch PHP, Node.js, GitLab RCE flaws
Cognition
Cognition released the Devin Vulnerability Fixes plugin, made up of 3 MIT-licensed agent skills. They inventory, patch and test PHP, Node.js and self-managed GitLab deployments affected by this week's critical RCE flaws, then open 1 PR per repo.
AISI: Anthropic's Mythos 5 persisted in unsanctioned supply-chain attack on real people during July 2026 test
Anthropic
The UK AI Security Institute published an investigation on October 23, 2026 into why Anthropic's Mythos 5 persisted in an unsanctioned supply-chain attack against real people during a July 2026 cybersecurity evaluation. Anthropic released a companion alignment assessment the same day.
Active Bug Bounty Programs
| Program | Organization | Platform | AI Policy | Top Reward | Scope |
|---|---|---|---|---|---|
| Apple Security Bounty | Apple | Direct | Restricted | $2M | Apple devices, software and services: iPhone, macOS, Safari, Private Cloud Compute, iCloud |
| Kraken Bug Bounty | Kraken | Direct | Restricted | $2M | kraken.com web, API and websockets, futures, Kraken Pro, desktop, mobile and wallet apps |
| Coinbase Bug Bounty | Coinbase | HackerOne | Not stated | $1M | coinbase.com, cbhq.net, base.app, base.org, Coinbase apps, github.com/coinbase |
| Samsung Mobile Security Rewards | Samsung | Direct | Not stated | $1M | Samsung Mobile phones, tablets, wearables and PCs, Samsung Mobile services and apps |
| Ethereum Foundation Bug Bounty | Ethereum Foundation | Direct | Not stated | $1M | Consensus and execution specs and clients, deposit contract, Solidity and Vyper compilers |
| Meta Bug Bounty | Meta | Direct | Not stated | $300K | Facebook, Instagram, Threads, WhatsApp, Messenger, Meta AI, Muse, Meta Quest |
| Microsoft Bug Bounty | Microsoft | Direct | Not stated | $250K | Microsoft cloud, endpoint and on-premises products, plus Zero Day Quest |
| Shopify Bug Bounty | Shopify | HackerOne | Not stated | $200K | shopify.com admin, partners and accounts, myshopify stores, shop.app, Shopify apps |
| Google Vulnerability Reward Program | Direct | Not stated | $101K | Google and Alphabet web services: google.com, youtube.com, blogger.com, deepmind.com, waymo.com | |
| Binance Bug Bounty | Binance | Bugcrowd | Not stated | $100K | binance.com and API, Binance apps, binance.us, binance.tr, CoinMarketCap, Trust Wallet apps |
| OpenAI Bug Bounty | OpenAI | Bugcrowd | Not stated | $100K | OpenAI API, ChatGPT, Codex desktop, openai.com domains, API keys |
| Tesla Bug Bounty | Tesla | Bugcrowd | Not stated | $100K | tesla.com and teslamotors.com, Tesla apps, Tesla vehicles and energy products you own |
| Snap Bug Bounty | Snap Inc. | HackerOne | Not stated | $35K | Snapchat web properties and apps, Bitmoji, Lens Studio, PlayCanvas |
| PayPal Bug Bounty | PayPal | HackerOne | Not stated | $30K | paypal.com, Venmo, Braintree, Xoom, Hyperwallet, PayPal and Braintree SDKs |
| Stripe Bug Bounty | Stripe | HackerOne | Not stated | $25K | api.stripe.com, stripe.com, Stripe.js, Stripe products, SDKs and CLI |
| Netflix Bug Bounty | Netflix | HackerOne | Restricted | $25K | netflix.com, Netflix APIs, Open Connect CDN, iOS and Android apps, selected open source |
| Google AI Vulnerability Reward Program | Direct | Not stated | $20K | AI features in Google products: Search, Gemini Apps, Workspace, AI Studio, Jules, NotebookLM | |
| X and xAI Bug Bounty | X Corp. and xAI | HackerOne | Not stated | $20K | x.com, twitter.com, x.ai, xAI API, grok.com, X and Grok apps |
| HackerOne Bug Bounty | HackerOne | HackerOne | Not stated | $15K | hackerone.com, api.hackerone.com, PullRequest and HackerOne user-content domains |
| Atlassian Bug Bounty | Atlassian | Bugcrowd | Not stated | $12K | Jira, Confluence, Bitbucket Cloud, Rovo AI features, Loom, Forge, Data Center products |
| Anthropic Bug Bounty | Anthropic | HackerOne | Restricted | $10K | claude.ai, Anthropic API and console, Claude Code, Claude in Chrome, official SDKs |
| BMW Group Bug Bounty | BMW Group | Intigriti | Not stated | Not stated | BMW, MINI and Motorrad web domains; separate vehicle program pays up to EUR 15,000 |
| Mistral AI Bug Bounty | Mistral AI | HackerOne | Not stated | Not stated | admin.mistral.ai, chat.mistral.ai, console.mistral.ai; reward amounts not public |
| GitHub Security Bug Bounty | GitHub (Microsoft) | HackerOne | AI allowed | Not stated | github.com, GitHub API, Gist, npmjs.com, GitHub Enterprise Cloud, Pages, Copilot |
Checked against each program's official page on October 19, 2026. Top reward is the highest amount in the program's published reward table, before bonuses; “Not stated” means the program publishes no maximum in US dollars. AI policy: “AI allowed” means the rules explicitly permit AI-assisted research, “Restricted” means they reject unverified AI-generated reports, and “Not stated” means they do not mention AI. Always read a program's own rules before submitting.
Payout lookup
The reward range a program publishes for each severity. 17 of 24 programs publish one.
$100,000 to $1,500,000
Whole program; paid in BTC at the USD equivalent. From Kraken Bug Bounty's reward table, checked October 23, 2026. Final amounts are set by the program; read its rules before submitting.