Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Microsoft’s AI bug bounty launched in October 2023 with awards of up to $15,000 and AI-powered Bing as its first in-scope product. That figure is historical: Microsoft’s current Copilot Bounty page lists awards from $250 to $30,000, depending on the finding and report. Its scope now covers several Copilot experiences, not just Bing. Microsoft announced the original program on October 26, 2023; the current program page records a launch date of October 12, 2023, and subsequent changes to scope and awards.
What Microsoft announced in 2023
Microsoft said in October 2023 that it had launched a new AI bug bounty, informed by AI research challenges and work on classifying AI-system vulnerabilities by severity. The first in-scope product was the AI-powered Bing experience, and the announcement advertised awards of up to $15,000. Those terms describe the launch announcement, not the current maximum.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Xbox Physical Gift Card | $25.00 | Buy on Amazon |
| 2 |
|
Airbnb eGift Card | $1,000.00 | Buy on Amazon |
| 3 |
|
Google Play gift code | $100.00 | Buy on Amazon |
The program page is now titled Microsoft Copilot Bounty. Its revision history shows that the program’s scope and award terms have changed since launch, so the original headline figure should not be read as a current limit.
How much can a researcher earn now?
Microsoft’s current Copilot Bounty page lists awards from $250 to $30,000. The applicable amount depends on the vulnerability category, severity, and quality of the report. Microsoft says it may award more than the listed amounts at its sole discretion, taking severity, impact, and submission quality into account. The range describes program terms, not a guaranteed payment for every report.
#1 Best Overall
- XBOX GIFT CARD: Buy full digital game downloads, game add-ons, in-game currency, memberships, devices, apps, movies, TV shows, and more.
- DIGITAL GAMES: Choose from hundreds of games, from AAA to indie options. Start playing the moment your most anticipated game is available when you pre-order and pre-download it.
- GAME AD-ONS: Extend the experience of your favorite games with add-ons and in-game currency.
- MOVIES & TV SHOWS: Rent or buy new and popular movies and TV shows from a massive library.
- PERFECT GIFT: Great as a gift for a friend or yourself. Xbox Gift Cards are easy to use, never expire, and give the freedom to pick the gift they want. Enjoy more ways to play without a credit card attached to your Microsoft account.
| Program details | October 2023 launch announcement | Current Copilot Bounty page |
|---|---|---|
| Program name | Microsoft AI bug bounty program | Microsoft Copilot Bounty Program |
| Award terms | Up to $15,000, as stated in Microsoft’s October 26, 2023 announcement | $250–$30,000, according to Microsoft’s page accessed September 30, 2026; amounts vary by category, severity, and report quality |
| Scope | AI-powered Bing was the first in-scope product | Multiple Copilot experiences listed on the current program page |
Which Copilot products are in scope?
The current page lists these Copilot AI experiences for testing:
- Copilot in a browser at copilot.microsoft.com and copilot.ai
- Copilot in Microsoft Edge on Windows, including Copilot Mode
- Microsoft Copilot apps for iOS and Android
- Copilot integrated into Windows through the Microsoft Copilot Application
- Copilot on WhatsApp and Telegram
Microsoft specifies that researchers must test with a personal account. Scope and terms can change, so check the program page before testing.
Rank #2
- Redeemable for merchandise and services on airbnb.com only.
- Redemption: Online only
- No returns and no refunds on gift cards.
- Gift Cards can only be purchased by or gifted to individuals in the United States
- Additional terms apply, see airbnb.com/terms/gift_cards.
What kinds of AI bugs qualify?
A report must demonstrate a direct security impact, satisfy Microsoft’s severity criteria, and reproduce on the latest fully patched version of the service. A prompt that produces an unexpected answer is not, by itself, enough to establish a bounty-eligible security issue. Microsoft’s listed exclusions include prompt injection that creates no security impact for anyone beyond the attacker, model hallucinations about running arbitrary code, and disclosure of system or meta-prompts. The page also excludes some common low-impact or out-of-scope vulnerability types, and Microsoft retains discretion to reject submissions.
How to submit a report
- Reproduce the issue on the latest fully patched version of an in-scope Copilot experience, using a personal account.
- Submit the report through the MSRC Researcher Portal and select “Copilot, AI+ML, and LLMs” as the product.
- Include the conversation ID in the reproduction steps and explain the attack vector, along with the evidence needed to demonstrate the security impact.
Microsoft’s Copilot Bounty terms provide the applicable severity criteria, scope, and submission requirements. Review them before testing because an issue that falls outside the rules may not qualify.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- No returns and no refunds on gift cards. Good for use on the US Google Play Store only. Terms apply - see below.
- Google Play gift codes can be used on the Google Play Store, the official app store for Android, to purchase apps, games, and more.
- To redeem, enter code in the Play Store app or play.google.com.
- Endless games to explore: Find and play old and new favorites – from mind-bending puzzles to epic quests and more.
- Just the app you’re looking for: Millions of apps means millions of ways to get things done, learn something new, and maybe even meet someone special.
Disclosure and safe testing
Microsoft says MSRC handles external vulnerability reports through coordinated vulnerability disclosure: MSRC coordinates investigation and remediation, and confirmed vulnerabilities may lead to mitigations and public information. The general Microsoft Bounty Programs guidance asks researchers to report privately and allow time for remediation before public disclosure. It also says not to access, modify, or exfiltrate customer data, and not to disrupt service availability.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
