alt Hacker News> OpenAI confirmed both frontends rejected the reported messages, resolved the issue, and awarded a total bounty of $5,000.
It requires the user to click a link. But I still find this bounty very low. Others may not report them if such a small bounty is given.
Replies
I took over user accounts in Microsoft Copilot (there are caveats but still), and they asked me to provide additional information of the exploit (they wanted a video) and before I sent it they fixed the vulnerability, didn't pay me a cent. Fair? Idk.
I find Sam Altman recent comments very "low" as well, neither matters. So in that case I think bounty hunters should just cold shoulder idiocracy and sell these to the underground. Let their customers be abused and complain about how OAI isn't protecting them. Each one of these types of events could cost them thousands of dollars in lost revenue and/or internal support.
They have just announced free API credits for Pro plan users up to $500 per month. Irony.
That’s so low. That’s the level of bounty I awarded researchers when I was managing the bug bounty program at a small startup, it’s just ridiculous coming from a large company like OpenAI
Not worth the effort for a company supposedly worth a trillion dollars. The problem is oai can't afford all of its mistakes at the usual rate and they make bad press. A 100k bug could make a headline, but 5k for the same bug requires the average person to be educated enough to understand how bad these issues are.
This is a pet peeve of tptacek:
> server-side vulnerabilities are worth very little, because they quickly get patched.
Indeed, it's like "here peasant, have this fortune of $5,000, may it change your life". Pathetic.
A bounty like this is a polite "thanks asshole, fuck off, don't do it again" rate.
Paying effectively nothing for vulnerabilities just means they don't want to deal with the program.
Wild to think a company supposedly worth a $trillion+ is doing shit like this.