Anthropic, Microsoft, and Google Paid Bug Bounties for AI Agent Vulnerabilities but Stayed Silent

Security researcher Aonan Guan exploited prompt injection vulnerabilities in AI agents from Anthropic, Google, and Microsoft through their GitHub Actions setups, successfully stealing API keys and tokens. Each company rewarded the findings with bug bounties—Anthropic paid $100, GitHub $500, and Google an undisclosed amount. Despite these payouts, none of the companies issued public advisories or disclosed the flaws to the broader community.