Microsoft announced that between July 1 2025 and June 30 2026 it paid more than $20 million in bug bounty rewards to 562 researchers, the highest amount and the largest number of submissions in the program’s history.

The bounty program was expanded in December 2025 to include critical vulnerabilities that directly affect Microsoft’s online services, even when the vulnerable code is part of third‑party or open‑source projects. Under the new “In Scope By Default” policy, Microsoft said $800,000 in rewards became eligible that were not previously covered, and $2.3 million was paid through the Zero Day Quest challenge.

Patch Tuesday vulnerability counts rose sharply, with 622 disclosures in July, a record that surpassed the previous July total of 206. Earlier months also set high totals, with 165 disclosures in April and 137 in May. Microsoft attributed the increase in submissions to greater use of artificial intelligence by internal teams and external bounty hunters, and said its own AI models contributed to the higher number of vulnerabilities identified during regular update cycles.

The company also noted that automated patching tools are available to customers, but it has not announced new mechanisms to address issues caused by recent Windows updates. A separate dispute involving a researcher known as NightmareEclipse highlighted tensions over disclosure practices, as the researcher published zero‑day exploits outside coordinated channels after several Patch Tuesdays.