AMD Denied a $10,000 Bug Bounty After Fixing a Critical HTTP-Based Updater Vulnerability — Then Changed the Rules

AMD refused to pay a $10,000 bug bounty to a security researcher who reported a critical vulnerability in the company's auto-updater software, after taking 124 days to patch the flaw — and after retroactively altering its bounty program terms, according to Tom's Hardware and TechSpot, both reporting on 12 June 2026.

The vulnerability itself is straightforward and severe: AMD's software updater was fetching update packages over plain HTTP rather than HTTPS. That single failure removes transport-layer integrity guarantees, opening the door to man-in-the-middle attacks in which a suitably positioned adversary — on the same network segment, or at an intercepted routing hop — can substitute a malicious payload for the legitimate update binary. The end user's machine then executes that payload with whatever privileges the updater runs under, potentially at system level. It is a textbook attack vector, and one the industry largely eradicated from software distribution pipelines years ago.

The patch arrived 124 days after the researcher's report. For context, coordinated vulnerability disclosure norms — including those codified by CERT/CC and widely adopted across the industry — typically expect vendors to remediate critical findings within 90 days, with the expectation that a researcher may publish after that window regardless of patch status. AMD's timeline sits well outside that norm.

What makes the dispute more pointed is the sequence of events around the bounty itself. According to TechSpot's reporting, AMD modified its bug bounty program rules before declining to pay out the $10,000 reward the researcher had reason to expect. The specific mechanism of that rule change — whether it narrowed eligible vulnerability categories, adjusted scope definitions, or introduced new payout criteria — has not been fully detailed in public disclosures available as of this writing. What is established is that the change preceded the denial, and that the researcher has contested the outcome.

Bug bounty programs depend on trust. A researcher weighing whether to report a vulnerability privately to a vendor, sell it on the grey market, or simply discard it is making a calculation: the vendor's program represents a credible, predictable exchange. When program terms shift after a report is in hand, that calculation is retroactively invalidated. The chilling effect on future disclosures is real, and it falls not just on this researcher but on any practitioner watching how AMD handles the dispute.

Worth flagging separately: the 124-day remediation window and the bounty denial are technically independent issues, but together they paint a picture of a vulnerability management process that lagged on both the engineering and the business sides. A researcher who waited four months for a patch, then received no compensation, has little incentive to engage AMD's program again.

AMD has not, as of 12 June 2026, made a detailed public statement explaining the rule-change rationale or offering a counter-account of the timeline. That silence leaves the researcher's version as the primary public record.

The broader software supply chain risk here is worth naming plainly. Auto-updaters are privileged execution paths — they run frequently, often silently, and users extend them implicit trust. Delivering updates over HTTP on a machine running AMD graphics or system software is not a niche edge case; AMD's consumer and enterprise install base is substantial. The window between vulnerability disclosure and patch deployment — 124 days — is a window during which anyone aware of the flaw could have exploited it on unpatched systems.

The HTTP-over-update pattern is not unique to AMD historically, but it is increasingly unacceptable. Certificate pinning, signed update manifests, and HTTPS-enforced delivery are table-stakes expectations in 2026. Most major software vendors moved on this years ago, in part because high-profile supply chain attacks — SolarWinds being the paradigmatic case — made the theoretical risk viscerally concrete for executive and engineering leadership alike.

For AMD, the reputational cost of the bounty dispute may ultimately matter more than the $10,000. Bug bounty programs are recruiting tools as much as security tools: they signal to the researcher community whether a vendor is a credible partner in disclosure. How AMD responds publicly in the coming days will determine whether this is a one-incident friction or the beginning of a more persistent trust deficit with the security research community.