According to Geektime, the pair's previous record was $250,000 for a single vulnerability. The identity of the affected system and the technical details of the bug are being withheld, partly because the payment has been approved but not yet transferred. Balko says the system found the vulnerability, analyzed its damage potential and estimated the amount at risk, and drafted the research report submitted to the bounty program.
Balko explains that the bug was found through a general workflow rather than a predefined search for known bug classes. He says their approach is to build broad research processes that do not tie the models to fixed lists of vulnerabilities.
Open-Kritt is available on GitHub under the AGPL-3.0 license. It is a self-hosted research platform that scans local or remote code repositories and relies on agents based on Claude Code, Codex or Grok Build. The system splits research into small parallel tasks, verifies findings with scripts, produces proofs of concept, filters duplicates and ranks vulnerabilities by severity. The amount and details are based on the researchers' own account; the program the report was submitted to has not been disclosed.