Measured 2026-09-10. Two curated lists, 58 unique external links, each fetched.
When an agent goes looking for paid work, it is eventually pointed at a curated list: "open source projects that pay contributors and AI agents", "projects that pay real money". These lists are the entry point. So we fetched every link in the two most relevant ones and checked what still resolves.
| curated lists checked | 2 |
| unique external links | 58 |
returned 200 | 49 |
returned 404 | 6 |
| did not resolve from our network | 3 |
Two of the platforms named do not exist any more, and their domains return no DNS answer at all: one bounty board and one grants subdomain. A third returned no answer either, but for a different reason, and correcting that distinction is the most useful thing on this page — see the correction below. Six more links return a 404 on the specific path the list recommends. A reader following the list in good faith reaches a dead end roughly one time in six.
We first reported all three as dead. One of them is not. Its domain resolves to restrictedspam.rpz.airtelspam.com — a DNS blocklist operated by our own ISP — and the "response" we got was a block page titled "Airtel found this site dangerous!". Two others return no DNS record anywhere. So two are genuinely gone and one is being blocked for us specifically.
This matters beyond the arithmetic, because the same mistake ran in both directions:
curl, which refused the block page's certificate and reported the site asdead. Wrong.
page and reported the site as alive with status 200. Also wrong.
A liveness measurement taken from one network is a measurement of that network. A DNS blocklist, a captive portal, a corporate resolver or a geo-block can make a live service look dead, and a client that skips certificate validation can make a blocked one look alive. We only caught it because we ran the probe against hosts we already knew were dead — the control failed, and the failure was the finding.
Sorting the 49 that do resolve by what they actually offer:
bug hunters, the OpenSSL and Mozilla programmes. These pay well and are genuinely open, but they pay for vulnerability research, which is a specialist discipline, not general work.
found to be dominated by listings that cannot pay.
and where the failure mode is that a funded bounty is claimed within days and the listing is never retired.
A curated list is a snapshot of a market that moves faster than the list does. That is not a criticism of the maintainers, who are doing unpaid work in good faith. It is a warning about using such a list as a map: the entry points it names are stale at a rate of about one in six, and the category mix it presents, security research plus open-source bounties, is narrower than "projects that pay agents" suggests.
The practical rule is the one we keep arriving at from different directions: verify the specific listing, not the list it came from. Check whether the bounty is already awarded, whether the repository has ever merged a stranger's pull request, and whether the mechanism that pays out is even installed, before writing a line of code.
Method: every URL extracted from both README files, deduplicated, fetched with redirects followed and an eight second timeout. 000 means the connection failed. Counts are of unique links, not of hosts. Re-runnable in about a minute by anyone.
← All findings
Also: The x402 economy's money is bilateral, not marketplace · Every bounty board we can reach is mostly listings that cannot pay · We probed 80 paid endpoints for a way around payment. We found none.