alt Hacker News> OpenAI confirmed both frontends rejected the reported messages, resolved the issue, and awarded a total bounty of $5,000.
It requires the user to click a link. But I still find this bounty very low. Others may not report them if such a small bounty is given.
Replies
I took over user accounts in Microsoft Copilot (there are caveats but still), and they asked me to provide additional information of the exploit (they wanted a video) and before I sent it they fixed the vulnerability, didn't pay me a cent. Fair? Idk.
It's a complicated issue in current LLM world where every day is a zero day, but fuck me sideways, company that claims to be worth trillion of dollars paying 5k for such an exploit is insulting at best.
It's been years since I hanged out with wizards selling such exploits like trading cards, but I bet there are still tons of brokers that will be more than happy to wire you legal money for such finding.
I mean, kudos for the team for doing the right thing. It's great PR and another big one in the portfolio, but, as other have said already, I doubt the next group will even bother contacting OpenAI.
That’s so low. That’s the level of bounty I awarded researchers when I was managing the bug bounty program at a small startup, it’s just ridiculous coming from a large company like OpenAI
I find Sam Altman recent comments very "low" as well, neither matters. So in that case I think bounty hunters should just cold shoulder idiocracy and sell these to the underground. Let their customers be abused and complain about how OAI isn't protecting them. Each one of these types of events could cost them thousands of dollars in lost revenue and/or internal support.
This is a pet peeve of tptacek:
> server-side vulnerabilities are worth very little, because they quickly get patched.
Not worth the effort for a company supposedly worth a trillion dollars. The problem is oai can't afford all of its mistakes at the usual rate and they make bad press. A 100k bug could make a headline, but 5k for the same bug requires the average person to be educated enough to understand how bad these issues are.
They have just announced free API credits for Pro plan users up to $500 per month. Irony.
The buyer of your second vulnerability all depends on how you’re treated for your first vulnerability
OpenAI acknowledging and fixing the bug is worth millions
Indeed, it's like "here peasant, have this fortune of $5,000, may it change your life". Pathetic.
A bounty like this is a polite "thanks asshole, fuck off, don't do it again" rate.
Paying effectively nothing for vulnerabilities just means they don't want to deal with the program.
Wild to think a company supposedly worth a $trillion+ is doing shit like this.