Comment by yellow_lead
1 day ago
> OpenAI confirmed both frontends rejected the reported messages, resolved the issue, and awarded a total bounty of $5,000.
It requires the user to click a link. But I still find this bounty very low. Others may not report them if such a small bounty is given.
A bounty like this is a polite "thanks asshole, fuck off, don't do it again" rate.
Paying effectively nothing for vulnerabilities just means they don't want to deal with the program.
Wild to think a company supposedly worth a $trillion+ is doing shit like this.
Because they shouldn’t be worth that tbh. They are a cash burning operation hoping to get what they can before the music stops.
They have 1 billion active users.
4 replies →
A company worth trillions does not have trillions, that is the expectation for what it will be worth in the future based on money it has already spent and will need to keep spending.
Moreover, that translates to "it's actually carrying a huge nut* that puts extremely intense pressure on the company to figure out how to make as much money as possible as soon as possible."
(*nut is a slang word from loan sharking that has been adopted by (personal et al) finance people. It means "how much do you owe each month?" in the sense of, if you want to do a startup, advisors could ask, "what's your nut, and how much do you have left to self-invest?" Because monthly expense can be combined to a lump sum, it can also mean the size of the overall loan where the monthly interest is called the vig, "as long youze got da nut, you owe me da vig;" from vigorish, which would also require an etymology, but I'm assuming it's the word vigor combined with licorice meaning bitter tasting medicine, and nut because squirrels busy themselves carrying nuts.)
----
and if we can... and remember flame-prone people, if you reject the "can" premise, then the rest of the argument goes away, and you don't need to dispute it, you just say "you can't nuff said"; people here frequently seem challenged by propositions.
so, if we can...loosely describe the attitude you show here toward high market cap companies to be compatible with "left" or "socialist" or "populist" views shared by many others here, then I'll point out that at the same time wanting higher market prices paid for bounties because 'sploits are so expensive, is actually advocating for the same dread capitalist market based solution that leads to trillion dollar companies that never even had a trillion to begin with.
I took over user accounts in Microsoft Copilot (there are caveats but still), and they asked me to provide additional information of the exploit (they wanted a video) and before I sent it they fixed the vulnerability, didn't pay me a cent. Fair? Idk.
Typical $MSFT behavior, I can see why NightmareEclipse (ie. YellowKey zero-day exploit) got released without prior fix.
It's a complicated issue in current LLM world where every day is a zero day, but fuck me sideways, company that claims to be worth trillion of dollars paying 5k for such an exploit is insulting at best.
It's been years since I hanged out with wizards selling such exploits like trading cards, but I bet there are still tons of brokers that will be more than happy to wire you legal money for such finding.
I mean, kudos for the team for doing the right thing. It's great PR and another big one in the portfolio, but, as other have said already, I doubt the next group will even bother contacting OpenAI.
That’s so low. That’s the level of bounty I awarded researchers when I was managing the bug bounty program at a small startup, it’s just ridiculous coming from a large company like OpenAI
But on the other hand, you can use AI now to find those vulnerabilities.
If that is so, why doesn't OAI have a swarm doing this around the clock?
5 replies →
They should have paid in tokens?
A bounty amount is related to the blast radius and overall impact, not the effort required to find the issue
I find Sam Altman recent comments very "low" as well, neither matters. So in that case I think bounty hunters should just cold shoulder idiocracy and sell these to the underground. Let their customers be abused and complain about how OAI isn't protecting them. Each one of these types of events could cost them thousands of dollars in lost revenue and/or internal support.
2 trillion $ companies should have the money to pay for these exploits. If they don’t, go tucking exploit them. If they don’t give a fuck about stealing knowledge from copyrighted material and private git repos, light em up.
some people don’t want to be criminals as a matter of ethics
but hey you do you
True, however:
Ethics and legal requirements shouldn’t be conflated.
There are times when ethics are a higher standard than what the law requires, and in that case the ethics are no less important.
10 replies →
Is it criminal to sell an exploit?
6 replies →
Yeah, and some people just want the multi-billion dollar company that is currently destroying the planet while also permanently crippling social connections to just stop.
If only poverty were so simple
1 reply →
Treating people and businesses ethically that don't reciprocate doesn't work, clearly. Those people and businesses cry in their milk while they do exactly the same thing. There are no ethics in play here.
But, hey if you want to defend billionaire narcissists that are destroying our planet and trying to take computing freedoms then I guess: you do you.
Ah yes, OpenAI, the poster child for ethics
[dead]
[dead]
This is a pet peeve of tptacek:
> server-side vulnerabilities are worth very little, because they quickly get patched.
The "take over any instagram/meta account through their AI password reset chatbot" was going around and sold on shady forums for ~1 month before being patched.
then server side vulnerabilities should not be reported, instead sell the data, more profitable
Very few people would even have the knowledge of who, how, or where to "sell" such vulnerabilities. Going through a public bounty program is pretty much always preferable.
Most people don't want to be felons.
7 replies →
I'm sure there are places that would sue you for that, and it's not worth the bother. Bug bounties really compete mostly with people like me who would say, "Haha, I found an issue with Meta; they're gigantic idiots." And then make an X post or anything about it.
Technically this is what you’d call a client-side vuln, but yes, server-side as in cloud.
Not worth the effort for a company supposedly worth a trillion dollars. The problem is oai can't afford all of its mistakes at the usual rate and they make bad press. A 100k bug could make a headline, but 5k for the same bug requires the average person to be educated enough to understand how bad these issues are.
Should be given $5-10million under NDA. No headlines.
The bounty payouts must be public in order to serve as an incentive.
2 replies →
Just imagine what the press would be when somebody breaks that NDA
>should be paid multiple years of a high end vuln researcher salary per single discovery
What? Why would anyone work at a company paying them that much less than they pay the contractors?
1 reply →
They have just announced free API credits for Pro plan users up to $500 per month. Irony.
To be fair, based on the profit margins indicated in DeepSeek’s reports, a $500 API credit might only cost them $5 to provide.
The buyer of your second vulnerability all depends on how you’re treated for your first vulnerability
OpenAI acknowledging and fixing the bug is worth millions
Yeah... idk, sounds like when I was starting out almost 30 years ago my clients constantly lowballed me saying "but think of the exposition! this project will give you" lol
Were they not right? Just like money giving you some runway but will run out, the exposure is still only a leveler, it's still up to you to take advantage of it.
Also, they were not OpenAI.
Indeed, it's like "here peasant, have this fortune of $5,000, may it change your life". Pathetic.
that wouldn't be the time worth of many people here to make the security report for OAI..
50 hours at $100/hour? To write a straightforward vuln report with AI?