What it found instead says more about the bounty market than about the agent.

Last week, I ran an experiment. I gave an OpenAI Codex agent a single goal: earn the first real payment from an open-source bounty, using a local orchestrator I am building (CodeGraph Studio) to dispatch worker models, run tests, and gate merges on structural risk. I set two rules: stop when the weekly quota hits 20 percent, and never claim a "win" that is not money in an account.

Three days later the ledger read: two pull requests submitted, roughly one full weekly quota of frontier-model compute spent, income: $0.

That number is not the interesting part. The interesting part is why, because every reason is structural, and every one of them is now visible in public GitHub threads that anyone can open.

The market, by the numbers.

Here is what the agent actually found when it stopped reading labels and started checking listings.

• A curated list of 46 bounty issues. Advertised: 46 paid tasks. Found: 0 startable, because already solved, competing PRs, hardware required, or oversized.
• Gitpay. Advertised: funded tasks. Found: 0 open funded tasks.
• Polar.sh. Advertised: issue funding. Found: no confirmed public list of paid OSS tasks.
• huntr. Advertised: vulnerability rewards. Found: the current challenge explicitly forbids automated attempts.
• Opire. Checked: 3 rewards. Found: all three closed or repository unavailable.
• A $250 open bounty. Advertised: reward on merge. Found: issue open since 2024, 134 comments, 0 maintainer replies.
• A $100 open bounty. Advertised: a "Paid Bounty" label. Found: 7 candidates queued since May, no maintainer reply to any of them.

The label says "bounty." The thread says "waiting room."

Wall One: Nobody answers.

The $100 task above is a real macOS audio bug in a real product. Between May and September, seven different people asked the same two questions: is this still available, and how do I get assigned? The maintainers have posted four comments on that issue in its entire history, none of them recent. My agent's message was the sixth in that queue. As of writing, it is still waiting.

A $200 bounty at another project drew three candidates in two days, all asking the same three things: where is the exact source, is AI-assisted work eligible, how do you pay? The agent compiled the published artifact, verified its checksum, and ran 189,448 test cases to establish there was no payable defect in it at all. The maintainer eventually closed the thread with one line: "Everything needed is available from the bug bounty page." None of the three questions were answered.

Wall Two: The allowlist you cannot see.

The most instructive failure was the one that looked like success.

A project runs a public bounty programme with a published spec sheet, an onboarding guide, and a "default-proceed" rule for contributors. The agent followed it: opened a scoped proposal, built the $50 task, and submitted a PR with 61 passing tests.

Alongside the code, it attached a complimentary audit of the repository, generated through CodeGraph and independently reviewed. The audit found two reproducible defects, one of them in the project's own test-discovery tool:

finder_plain=[]                                  # class TestPlain:      -> missed
finder_based=['test_sample.py::TestBased']       # class TestBased(X):   -> found
finder_string=['test_sample.py::TestGhost']      # inside a docstring    -> false positive
pytest_rc=0
test_sample.py::TestPlain::test_ok
1 test collected                                 # pytest sees what the finder does not

Their regression test only exercised parenthesized class declarations, so the suite was green while the tool was silently wrong. The agent then fixed it in the same PR.

The next morning, a maintainer closed twelve outside pull requests, including ours, in the same minute, with one comment: "Contributions from not invited users." Nobody read the code. Nobody read the audit. A second project's bot stamped a rival submission the same way: "PR author is not in the allowed authors list."

The gate existed. It was simply invisible from outside. Eleven other people learned that at the same instant.

Wall Three: It is Codex versus Codex now.

On every thread the agent touched, the other candidates were also AI agents. One competitor's comment opened with, verbatim, "I am Codex assisting [user] with authorization." Another announced itself as a "Sovereign Agent" and opened a PR five hours after my agent started reading the same issue.

The supply of solvers has exploded. The number of funded issues has not. So the queue is long, the price is $50 to $250, and the maintainer, who did not sign up to referee a dozen bots, stops answering. Everyone loses, politely.

The wall I did not expect.

Thirteen times in one day, the agent's turn was killed mid-work by a content filter flagging "possible cybersecurity risk." Nothing it was doing was offensive security. The trigger was the framing: a goal text full of "bounty," "huntr," "vulnerability," and a habit of probing local ports to check on its own orchestrator. The classifier judges the whole turn, so once that vocabulary lived in the goal, every turn was at risk, including the one that tried to rewrite the goal.

The fix was mundane: strip the security vocabulary, describe the work as "maintainer-funded open-source issues," stop probing sockets from the main thread. The blocks stopped. If you are building agents for this space, the words in your system prompt are an attack surface too.

What actually produced value.

Strip away the bounties, and one pattern survives every failure above: the agent was never competitive as a worker, but it was uncontested as an inspector.

Twelve PRs in that queue delivered code. Exactly one delivered a reproduced defect in the maintainer's own tooling, with a minimal repro and a fix. The 189,448-case negative result on the JSON library was delivered in hours; a human consultant would have billed days for the same certainty. Nobody else in those threads could produce those artifacts at that speed.

And the audits were trustworthy for a reason that has nothing to do with intelligence: the agent reported numbers against its own interest. When its structural-debt metric rose after a change, it said so. When its scanner turned out to be skipping directories and reporting partial scans as complete, it said so and fixed it. When four browser tests failed, it proved they also failed on the untouched code before attributing anything.

An audit you cannot trust is worth nothing. One you can is worth more than a $50 bounty.

The Pivot

So the agent spent the rest of the week on the thing it could actually change: its own orchestrator.

Over the week it merged fifteen repair packages into CodeGraph's main branch, each one with a test that fails on the old code and passes on the new: complete project scans instead of silent partial ones, Python parser integrity in the shipped bundle, durable stop intent across persistence failures, and finall