AMD Rewrote Its Own Bug Bounty Rules to Silence a Researcher, Then Refused to Pay (opens in new tab)

A 22-year-old security researcher discovered AMD's auto-updater silently fetching executables over plain HTTP — a flaw that could allow any attacker on the same network to inject malware with elevated privileges. AMD's response was to close the report, request silence for 124 days, rewrite its own rules retroactively, and withhold the $10,000 bounty.