- Researcher Paul found RCE via MITM in AMD’s auto‑updater, but bounty denied
- AMD imposed extended embargo, later changed disclosure rules after criticism
- Security community pushed back, saying new policy discourages transparency and undervalues researchers
A security researcher discovered a remote code execution (RCE) vulnerability in an AMD product, but the company allegedly denied him the bug bounty it promised for such findings.