Microsoft is offering security researchers up to $30,000 for finding critical AI vulnerabilities in Dynamics 365 and Power Platform, sharpening its focus on flaws that could manipulate AI inference or expose information through model behavior.
The program covers qualifying bugs in Microsoft-hosted services and third-party or open-source components embedded in them, provided researchers demonstrate a security impact on an in-scope service.
Under the bounty table, a high-quality report documenting critical “Inference Manipulation” or “Inferential Information Disclosure” can earn the maximum $30,000.
Medium- and low-quality reports for critical impacts are listed at $20,000 and $12,000, while important-severity findings can receive between $6,000 and $20,000 depending on report quality. Moderate- and low-severity AI submissions do not qualify for payment under this category.
The scope is broad because these platforms sit close to sensitive business data and automated workflows.
Eligible targets include Dynamics 365 Sales, Customer Service, Finance, Commerce, Human Resources, Business Central, Contact Center, Customer Insights and Supply Chain Management, alongside on-premises Dynamics products. It also covers Power Apps, Power Automate, Copilot Studio, Power Pages, Power Admin, AI Builder, and Dataverse.
| Vulnerability Category / Focus Area | Impact Severity & Quality Tier | Maximum Payout / Multiplier | Scope & Qualification Details |
| Inference Manipulation & Disclosure | Critical (High / Med / Low Quality) | $30,000 / $20,000 / $12,000 | Manipulates model responses or extracts data via model behavior |
| Important AI Vulnerabilities | Important (High / Med / Low Quality) | $20,000 / $12,000 / $6,000 | High-impact functional or security flaws across AI integrations |
| Remote Code Execution (RCE) | Critical Severity | Up to $20,000 | Code execution flaws across in-scope cloud and service components |
| Cross-Tenant Information Disclosure | High-Impact Scenario | Up to $20,000 | Breaches tenant boundaries to access external organization data |
| Elevation of Privilege / Info Disclosure | Critical Severity | Up to $12,000 | Local and cloud-level unauthorized privilege escalation |
| Dataverse & Sandbox Escapes | Special High-Impact Vectors | +20% Multiplier | Dataverse privilege escalation & Plugin Sandbox host escapes |
Microsoft requires AI findings to meet its Critical or Important severity definitions and reproduce on the latest, fully patched version of an eligible product.
Researchers must submit reports through the MSRC Researcher Portal and provide the Power Platform or Dynamics environment ID, the username used during testing, and whether the bug matches a high-impact scenario.
Clear reproduction steps, proof-of-concept material, affected versions, and an explanation of attacker impact can accelerate validation and support a higher award.
Beyond AI payouts, the bug bounty program assigns up to $20,000 for critical remote code execution, $12,000 for critical elevation-of-privilege or information-disclosure flaws, and $8,000 for critical spoofing or tampering reports.
Cross-tenant information disclosure carries a $20,000 high-impact award, while qualifying Dataverse privilege escalation and Plugin Sandbox “guest-to-host” escapes can receive a 20% multiplier. A report eligible for multiple awards receives only the highest qualifying payment, although Microsoft may grant more at its discretion.
The program distinguishes exploitable AI security failures from model quirks. Prompt injection affecting only the attacker, hallucinated code execution, attempts merely to reveal a system or meta prompt, and content-safety issues are excluded.
Publicly known bugs, denial-of-service attacks, blind cross-site scripting, dependency confusion, and configuration-dependent weaknesses are also generally out of scope.
Researchers should test only in accounts and tenants they own or are authorized to assess, stop immediately if unauthorized data becomes accessible, and avoid post-exploitation, lateral movement, phishing, or disruptive traffic.
Microsoft recommends marking research tenants with “MSOBB” where possible and following coordinated vulnerability disclosure, ensuring findings reach engineers without exposing customers or production services to risk.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
