I tried to make Claude make me money on open-source bounties. Here's the data from 60 fresh issues.

A few days ago a tweet from @chatgpt21 went around showing an AI coding agent that ran unsupervised for 22 hours, found a bounty on its own, shipped a PR, and got paid $16.88. 22M tokens spent, a real first dollar collected. The thread was triumphant: "the loop works."

I wanted to see if I could replicate it on a $20 token budget with Claude as the agent. I picked the closest public analog to what the tweet described: Algora, the open-source bounty platform where maintainers attach a dollar amount to a GitHub issue and the first acceptable PR gets the money.

Forty-eight hours later I have $0 and some data that I think is more interesting than a win would have been.

The setup

The plan, on paper, was simple:

• Discover open bounties via the public Algora board / GitHub label search
• Pick a small, scoped issue in TS / Python / Go (something a human reviewer could sanity-check)
• Let Claude clone the repo, attempt the fix, run tests
• Human-in-the-loop review of the diff before pushing a PR
• Stop hard at $20 of token spend

Budget enforcement and the human-review gate were the only real safety rails. Everything else was Claude driving from inside a chat session: gh CLI, git, Edit, Bash. About 30 minutes of scaffolding work and we were ready to attempt.

The first bounty I looked at was archestra-ai/archestra#3859, a $100 bounty on a TypeScript repo. Two minutes of reading made it clear we should not touch it:

1. It carries a yellow Reserved for SE interview label: "Please don't take it if you're not interviewing." The bounty is gated to hiring candidates.
2. The maintainer publicly banned a user named @sumithkumar07 earlier the same week "for attempting to steal another user's bounty."
3. The bounty had two PRs already submitted (#4311 and #4613) and a WIP from a third hunter.

Net: low probability of payout, high probability of getting the GitHub account flagged. Skipped.

That was the polite version of what every subsequent bounty looked like.

What the data actually shows

I built a small tool (scout.py, a couple hundred lines) to enumerate open Algora-labeled issues via gh search issues --label "💎 Bounty", filter out junk, and look at:

• the dollar amount (label-encoded like $50, $150)
• the /attempt comments (how many people raised hands)
• the issue's assignees (who maintainers picked)
• the number of open PRs linking back to the issue (who actually shipped)
• the days since the last comment (a stale-signal proxy)

On the first real scan (80 fresh, non-junk bounty issues), every single one fell into one of three buckets:

Bucket 1: $1 sandbox spam. A repo called UnsafeLabs/Bounty-Hunters posted ~30 issues in a single day, all $1. The fix amounts are below the token cost of attempting them. Skipped automatically.

Bucket 2: Already saturated. Every legitimate $50 to $1,000 bounty had between 8 and 158 attempts within hours of being posted, and 8 to 10 open PRs already in flight. Sample of the live pool:

You are not waiting on demand. You are the eleventh PR into a queue that the maintainer has been ignoring for a week.

Bucket 3: Assigned, untouched, and locked. A handful of bounties had a maintainer publicly say "@hunter, you're assigned, go ahead", and then the chosen hunter went silent for days while opportunistic competitors got their PRs closed without merge for muscling in. (See archestra-ai/archestra#4461 for a clean example: $50 bounty, two competing PRs both closed within 24 hours, official assignee silent for three days afterward.)

What broke the market is the same thing that made the tweet work in the first place: agents are now fast enough to claim a bounty within minutes of it being posted. The maintainer's review pipeline can't absorb 10 PRs per issue. They pick one and reject the rest. The expected value of being the 11th PR is roughly $0.

I'm fairly confident the original $16.88 win was on a private security/audit platform, not the public open-source firehose. The comments in the original thread reference "security platform" and "preserved payment boundaries," language that fits HackerOne/Bugcrowd-adjacent work better than gh pr create.

The thing I built anyway

The interesting strategy I tried after staring at the data for a while was not to compete with the agents racing to be first. It was to wait for them to drop. Bounty hunters claim aggressively but follow through inconsistently. An issue where someone has been officially assigned but hasn't shipped a PR after 14+ days of silence is, plausibly, abandoned.

scout.py runs in two passes:

1. Pull 60 to 80 open bounty issues; filter rewarded, reserved, junk, and out-of-range dollar amounts.
2. For each survivor: count /attempt comments, find any linked PRs (open, closed, or merged), measure days since last comment.

It flags a bounty as RIPE if: it was claimed, has no open PR, and has been quiet for 14+ days. It diffs against the previous scan and tags 🆕 NEW ripe candidates between runs.

I have scanned three times across two days. Zero ripe candidates. One borderline case (the Archestra #4461 above, currently at 2.2 days stale) is the only thing on the ripening track.

I think the strategy is still sound. It just needs more calendar time than I gave it. Two to four weeks of patient watching might surface a real candidate. Or it won't, and the market is broken even for harvesters.

I'm leaving the tool here either way:

scout.py: single-file Python script, MIT licensed

Requirements: gh CLI, Python 3.9+. Run python3 scout.py and you get a top-eight "warm" list and any ripe candidates. State persists in state/scout.json, so subsequent runs tag new arrivals.

Things I underestimated

A few things I'd flag for anyone trying to replicate the @chatgpt21 result:

• The public bounty market is fully agent-saturated. I expected this on the high-dollar issues. I didn't expect $50 issues on niche repos to attract 20+ attempts in a single day. Bots watch the issue feed and pile in before you finish reading the title.
• Reservation labels and hiring-candidate gates are everywhere. Several of the most-funded Algora orgs (Archestra is the clearest example) treat bounties as a hiring channel. If you're not in their interview pipeline, you're poaching, and at least one organization will straight-up ban accounts for it.
• Maintainer review is the bottleneck, not solution quality. Even a perfect PR submitted ninth probably loses to a mediocre PR submitted first.
• "$16.88 in 22 hours" implies 20+ jobs in parallel. Single-thread, $20-budget, public-platform replication is the wrong unit economics. The tweet author was running closer to a fleet than a script.
• The economics still aren't profitable per attempt. Even the original poster's run cost ~$16 in tokens to earn $16.88, in a single optimistic case. The "$506 run-rate" people in the replies were quoting comes from extrapolating 30 parallel agents on a flat-rate subscription, not from sustained pay-per-token economics.

What I'd do differently

If I were starting this experiment over with the same $20:

1. Skip Algora's public board entirely. Look at private programs on HackerOne, Bugcrowd, or domain-specific platforms where solution quality matters more than submission speed.
2. Pick one repo and become a contributor first. Maintainers ship bounties to people they trust. Becoming "someone they trust" is a slower play but probably the only honest one on the public OSS side.
3. Don't compete with agent farms head-on. Build for them: tooling like scout.py, dashboards, and monitors. Sell it to people running fleets.

Costs me nothing to admit I picked the wrong fork. If you've made a public-bounty agent loop actually work, not at 20-jobs-in-parallel scale but at one-job-one-dollar scale, I'd love to read about it. My DMs are open.

The tool, the data, and this writeup were all built in collaboration with Claude (Anthropic). If you found any of this useful, you can buy me a coffee. It goes directly to the budget for the next experiment.