> OpenAI confirmed both frontends rejected the reported messages, resolved the issue, and awarded a total bounty of $5,000.

It requires the user to click a link. But I still find this bounty very low. Others may not report them if such a small bounty is given.

▲

windexh8er 43 minutes ago | parent | next [-]

I find Sam Altman recent comments very "low" as well, neither matters. So in that case I think bounty hunters should just cold shoulder idiocracy and sell these to the underground. Let their customers be abused and complain about how OAI isn't protecting them. Each one of these types of events could cost them thousands of dollars in lost revenue and/or internal support.

	▲	throwaway98797 13 minutes ago \| parent [-]
		some people don’t want to be criminals as a matter of ethics but hey you do you

▲

jryle70 an hour ago | parent | prev | next [-]

OpenAI acknowledging and fixing the bug is worth millions

▲

dgellow an hour ago | parent | prev | next [-]

That’s so low. That’s the level of bounty I awarded researchers when I was managing the bug bounty program at a small startup, it’s just ridiculous coming from a large company like OpenAI

▲

amelius 29 minutes ago | parent [-]

But on the other hand, you can use AI now to find those vulnerabilities.

	▲	baxtr 18 minutes ago \| parent [-]
		They should have paid in token?

▲

thatsabadlook 2 hours ago | parent | prev | next [-]

Not worth the effort for a company supposedly worth a trillion dollars. The problem is oai can't afford all of its mistakes at the usual rate and they make bad press. A 100k bug could make a headline, but 5k for the same bug requires the average person to be educated enough to understand how bad these issues are.

▲

varispeed an hour ago | parent [-]

Should be given $5-10million under NDA. No headlines.

	▲	layer8 43 minutes ago \| parent \| next [-]
		The bounty payouts must be public in order to serve as an incentive.
	▲	goodmythical 8 minutes ago \| parent \| prev \| next [-]
		>should be paid multiple years of a high end vuln researcher salary per single discovery What? Why would anyone work at a company paying them that much less than they pay the contractors?
	▲	weird-eye-issue an hour ago \| parent \| prev [-]
		Just imagine what the press would be when somebody breaks that NDA

▲

dist-epoch 3 hours ago | parent | prev | next [-]

This is a pet peeve of tptacek:

> server-side vulnerabilities are worth very little, because they quickly get patched.

▲

dannyw 2 hours ago | parent | next [-]

The "take over any instagram/meta account through their AI password reset chatbot" was going around and sold on shady forums for ~1 month before being patched.

▲

throwaw12 an hour ago | parent | prev [-]

then server side vulnerabilities should not be reported, instead sell the data, more profitable

	▲	petcat 35 minutes ago \| parent [-]
		Very few people would even have the knowledge of who, how, or where to "sell" such vulnerabilities. Going through a public bounty program is pretty much always preferable. Most people don't want to be felons.

▲

varispeed an hour ago | parent | prev [-]

Indeed, it's like "here peasant, have this fortune of $5,000, may it change your life". Pathetic.

	▲	siva7 an hour ago \| parent [-]
		that wouldn't be the time worth of many people here to make the security report for OAI..