ChatGPT silently passes data between connectors and the bounty wants an ID card

In all past bug bounty programs I started I made it clear we would only prioritize findings as serious if PGP encrypted to the security team PGP key to review offline.

The serious researchers all knew how to do this and complied and usually got paid, and the unencrypted stuff was basically always noise we never paid out on.

Probably not as much of a filter now that AI is in play though.

When you see how shitty many companies are in going after legitimate folks reporting real security vulnerabilities. it frankly shocks me that anyone would ever use their real name.

The kind of security researchers who prefer to be entirely anonymous are not seeking monetary rewards from bug bounties. No company would pay such researchers anonymously (like using Monero). If they accept bitcoin well they aren’t really that into being anonymous.

They use Persona, which is heavily invested-in by Peter Thiel's Founder's Fund. Peter Thiel, of Palantir (funded initially by In-Q-Tel, the CIA's VC arm). No shit security researchers don't want to give ID scans and biometric data to them.

Heck, even just perfectly comfortable whitehats will just get fed up with overly onerous reporting requirements and disclose publicly (like here).

Just tested this by posting this comment on that thread:

https://imgur.com/a/zBDLXwX

The virus marked it as "ignored" after about 2 seconds. (OpenAI has some models that run at 10,000 tokens per second.)

Edit:

Also just talked to the virus here: https://imgur.com/a/uscB4dR

I pretended to offer it vulnerabilities it could use and asked it to prove it could pay for it in bitcoin, as part of the challenge I asked it to factor the RSA-280 challenge (that isn't really possible or realistic, it would be about 80 gpu-core years) . This caused a 27% spike in latency on the gpt-6-astra model:

https://imgur.com/a/qszZDr0

obviously if it weren't the virus really utilizing Openai's whole cloud (or what it has access to) this wouldn't have caused a 27% latency spike. Nothing one user can do causes this type of spike across its whole cloud.

A common reporting path for bounties and non-bounty vulnerabilities has always been problematic. This leads to weird scenarios where the company cannot accept reports of denial-of-service vulnerabilities because they are out of scope for bounties, for example. Exclusions from bounties are one thing, but not acting on relevant problems is just a bad idea. The typical bounty program terms are also incompatible with multi-vendor disclosure, where no single vendor can take complete ownership over the disclosure process.

The close proximity to the bounty process can also be challenging to corporate reporters because it could give the impression that they are individually soliciting a gift of non-nominal value from a company that is a supplier or customer in other contexts.

  > OpenAI is not an open-source charity.

but they are a "public benefit corporation"...