Uncovering Software Flaws with OpenAI's Rewards Program

Uncovering Software Flaws with OpenAI’s Rewards Program

If you’re a security researcher, ethical hacker, or technology enthusiast, OpenAI is asking for your help. And it’s not for free.

MUO VIDEO OF THE DAY

SCROLL TO CONTINUE WITH CONTENT

On April 11, 2023, OpenAI announced a bug bounty program as part of its commitment to developing reliable, secure, and advanced AI systems, and anyone with the right skill set can potentially help out.

Disclaimer: This post includes affiliate links

If you click on a link and make a purchase, I may receive a commission at no extra cost to you.

What Is OpenAI’s Bug Bounty Program?

OpenAI announced its Bug Bounty Program to incentivize those using their applications, such as ChatGPT and DALL-E, to create secure, advanced, and globally beneficial AI systems.

Anyone who finds and reports vulnerabilities in OpenAI’s systems will earn cash rewards, resulting in a win-win situation. While participants earn money, the company’s systems become safer.

OpenAI promises to protect you from liabilities or penalties if you follow its stated guidelines and will also acknowledge submissions and remedy validated vulnerabilities promptly. Furthermore, OpenAI claims it will publicly recognize your contribution if it is unique and leads to a configuration or code change.

However, you cannot disclose your vulnerability-related findings to the public after submitting them.

This bug bounty program covers vulnerabilities in all OpenAI systems, including API targets and keys, ChatGPT, and the research organization. However, the initiative does not cover safety issues with OpenAI’s model, including safety bypasses and getting the model to create malicious code. In addition, the firm will not be rewarding issues related to model prompt content or responses and AI hallucinations . You may report these to OpenAI’s team for model behavior feedback.

How Much Can You Earn From OpenAI’s Bug Bounty Program?

OpenAI determines the cash rewards to be paid based on how severe and impactful the discovered bug is. Typically, the reward ranges from $200 to $6,500 per vulnerability but can be higher if your findings are exceptional and of great consequence.

The maximum reward you can earn is $20,000.

At first, the priority level of your finding, along with your reward, will be determined using Bugcrowd’s Vulnerability Rating Taxonomy . However, if it deems it necessary, this level and your reward may be modified by OpenAI.

Additionally, the AI research company will not reimburse you for any purchases or upgrades you make when identifying or testing for bugs.

How to Participate in OpenAI’s Bug Bounty Program

Since Bugcrowd facilitates this bug bounty program, you must create a Bugcrowd account to participate. OpenAI even suggests you carry out authorized additional testing using an “@bugcrowdninja.com” email address.

With a Bugcrowd account, you can click the “Submit Report” tab on the Bugcrowd OpenAI program page to report vulnerabilities. This will lead you to the submissions page.

Here, you must fill in the following information:

A title clearly and briefly describing the vulnerability
The target of the discovered vulnerability
The vulnerability type
The URL or location of the vulnerability
The description of the flaw and its impact
Proof-of-concept scripts, screen recordings, or attachments depicting the bug
The researchers and collaborators on the submission

After filling in these details, agree to Bugcrowd’s terms and conditions and click “Report Vulnerability.”

Note that you are not to submit API keys to Bugcrowd. You must only submit keys you find online through the OpenAI API key form .

Which Vulnerabilities Are Eligible for Rewards?

You will be rewarded for any security, functionality, performance, and documentation vulnerability you find in api.openai.com, third-party targets, ChatGPT, ChatGPT plugins, https://openai.org , */openai.org, OpenAI API keys, openai.com, */openai.com, and developer platform playground.

These include server-side injection, server security misconfiguration, cross-site scripting (XSS), insecure OS/firmware, insecure data storage, cross-site request forgery (CSRF), and broken authentication and session management.

All the vulnerabilities must be in OpenAI’s system, exploitable, and novel.

Earn Money While Improving OpenAI’s Systems

OpenAI’s bug bounty program is a great way for you—as an ethical hacker, security researcher, or tech enthusiast—to earn while improving the firm’s AI systems.

However, ensure you comply with all specified guidelines and rules of engagement.