6 ms·

OpenAI – vulnerability responsible disclosure

221 points by requilence 1y ago

requilence 1y ago
Reported a flaw to OpenAI that lets users peek at others' chat responses. Got an auto-reply on May 29th, radio silence since. Issue remains unpatched :( Avoided their bug bounty due to permanent NDAs preventing disclosure even after fixes. Following standard 45-day disclosure window—users should avoid sharing sensitive data until this is resolved.
- fcpguru 1y ago
  well done, sounds very reasonable and following the rules.
  - requilence 1y ago
    Appreciate it. Just trying to do the right thing by both OpenAI and users here.
- poniko 1y ago
  The NDA part feels really murky.
  - tptacek 1y ago
    It's pretty standard for bounty programs. If you don't like it, which is reasonable, do what this researcher did and just post independently.
    - pyman 1y ago
      The bug bounty world is a funny one. I remember one complaining that their bug was dismissed and fixed after they signed an NDA, no payout, nothing. Another one got $100 instead of $5,000 because the company downgraded the severity from high to low. So they ended up with little or no money, and no recognition either. Not sure if these were edge cases, but it does make you wonder how fair the process really is.
      - tptacek 1y ago
        If you're dealing with large companies, a good rule of thumb is that the bounty program is incentivized to pay you out. Their internal metrics improve the more they pay; the point is to turn up interesting bugs, and the figure of merit for that is "how much did we have to spend". At a large company, a bounty that isn't paying anything out is a failure. All bets are off with small random startups that do bug bounties because they think they're supposed to (most companies should not run bounties). But that's not OpenAI. Dave Aitel works at OpenAI. They're not trying to stiff you. Simultaneous discovery (either with other researchers or, even more often, with internal assessments) is super common. What's more, you're not going to get any corroboration or context for them (sets up a crazy bad incentive with bounty seekers, who litigate bounty results endlessly). When you get a weird and unfair-seeming response to a bounty from a big tech company, for the sake of your own sanity (and because you'll probably be right), just assume someone internal found the bug before you did, and you reported it in the (sometimes long) window during which they were fixing it.
        pyman 1y ago
        Interesting insights, thanks for sharing
    - asadotzler 1y ago
      That's an exaggeration. Most industry leaders do not require NDAs, only coordinated disclosure. Mozilla's program, which has been around longer than most, doesn't. Google and Microsoft don't. Meta and Apple don't. This is water carrying, intentional or not, for a terrible practice that should be shamed, so that it doesn't become standard.
      - tptacek 1y ago
        My understanding is that all Bugcrowd bounties do by default. You can shame it all you want, but you can also just publish your bugs directly. Nobody has to use the Bugcrowd platform. You don't even have to wait 45 days; I don't buy these "CERT/CC" rules.
        asadotzler 1y ago
        You said it was pretty standard for bug bounty programs, and I disagreed pointing to several of the largest and longest lived bug bounty programs, none of which do that, and your response is pointing out that one particular platform does it? Even among 3rd party platforms, of which there are several bigs, the NDAs are not a platform requirement, just an option for participating firms. NDAs are not the norm. Don't mislead people who would otherwise get into this game with non-issues they need not worry over.
        tptacek 1y ago
        OpenAI's security team commented on the thread themselves that they believe they simply accepted the Bugcrowd defaults. I think you're trying to find a controversy that just isn't here.
- jonrouach 1y ago
  you're sure it's not their "feature" that calling the api with empty string returns random hallucinations? https://jarbon.medium.com/gpt-prompt-bug-94322a96c574 https://jarbon.medium.com/gpt-prompt-bug-94322a96c574
  - requilence 1y ago
    No, definitely not the empty string hallucination bug. These are clearly real user conversations. They start like proper replies to requests, sometimes reference the original question, and appear in different languages.
    - JyB 1y ago
      I don’t see anything here that would prevent a LLM from generating these. Right?
      - requilence 1y ago
        In one of the responses, it provided the financial analysis of a not well-known company with a non-Latin name located in a small country. I found this company; it is real and numbers in the response are real. When I asked my ChatGPT to provide a financial report for this company without using web tools, it responded: `Unfortunately, I don’t have specific financial statements for “xxx” for 2021 and 2022 in my training data, and since you’ve asked not to use web search, I can’t pull them live.`.
        Sebguer 1y ago
        Do you understand what a hallucination is?
        jojobas 1y ago
        Coming up with accurate financial data that you can't get it to report outright doesn't seem like one.
- maxlin 1y ago
  Permanent NDA's? Oof. It's like their plan is to just try to force the lid down till they reach ASI or something lol
  - tptacek 1y ago
    Again: NDAs are bog standard bounty terms.
- 999900000999 1y ago
  Users should always avoid sharing sensitive data. A lot of AI products straight up have plan text logs available for everyone at the company to view.
  - ameliaquining 1y ago
    Which ones? Do you just mean tiny startups and side projects and the like or is this a problem that major model providers have?
  - pyman 1y ago
    It's not just about sensitive data like passwords, contracts, or IP. It's also about the personal conversations people have with ChatGPT. Some are depressed, some are dealing with bullying, others are trying to figure out how to come out to their parents. For them, this isn't just sensitive, it's life-changing if it gets leaked. It's like Meta leaking their WhatsApp messages. I really hope they fix this bug and start taking security more seriously. Trust is everything.
    - milkshakes 1y ago
      maybe you should stop trusting random people on the internet making extraordinary claims without proof then?
      - baby_souffle 1y ago
        Isn't "assume vulnerable" The only prudent thing to do here?
        refulgentis 1y ago
        No? Yes? Mu? After some hemming and hawing, my most cromulent thought is, having good security posture isn't synonymous with accepting every claim you get from the firehose
        milkshakes 1y ago
- com2kid 1y ago
  I see other users conversations on my Gemini dashboard, not sure who to even complain to. Software quality is... Minimal now days.
- deleted 1y ago
  [deleted]
novia 1y ago
https://archive.is/mYehH https://archive.is/mYehH
JyB 1y ago
I believe it is extremely important to disclose that the ‘responses leaks’ you obtained did not originate from LLM models themselves, but rather through other insecure systems / in a more conventional manner. Just to avoid yet another case of hallucinations outputs getting misinterpreted.
- requilence 1y ago
  Right, thank you for the suggestion. Just added a paragraph to the original blog post.
  - tabletcorry 1y ago
    Your added paragraph appears to suggest the opposite, that this was an LLM response. Was the "leaked data" a response from an LLM directly?
    - JyB 1y ago
      Yes apparently which makes this report pretty flimsy.
      - tptacek 1y ago
        Upthread, OpenAI's security team confirms it's a false report; it's a variant of the empty-prompt hallucination.
        JyB 1y ago
        Incredible that so many people still don't understand what an LLM is. Especially ones that you would expect to grasp it.
pyman 1y ago
> A single misconfiguration can leak thousands of sensitive conversations in seconds. Treating privacy as an afterthought is untenable when the blast radius is this large. Massive security bug, well spotted. It's like Bank of America showing other people my transactions, or Meta leaking my WhatsApp messages. This raises some serious questions about security.
jofzar 1y ago
I'm curious which mailbox they sent to, trying to find a mailbox is surprisingly hard even with my Google searching.
- requilence 1y ago
  they have security.txt file on their domain and mentioned it in some other place
blibble 1y ago
good to see more and more hackers refusing to use corporate bug bounty platforms with onerous terms I certainly wouldn't sign an indefinite NDA for a chance to win: Average payout: $836.36 openai should be grateful, after all, they want all information to be free
rglover 1y ago
Thank you for sharing and reporting this.
thorum 1y ago
> The leaked responses show clear signs of being real conversations: they start with contextually appropriate replies, sometimes reference the original user question, appear in various languages, and maintain coherent conversational flow. This pattern is inconsistent with random model hallucinations but matches exactly what you'd expect from misdirected user sessions. A model like GPT-4o can hallucinated responses that are indistinguishable from real user interactions. This is easy to confirm for yourself: just ask it to make one up. I’m certainly willing to believe OpenAI leaks real user messages, but this is not proof of that claim.
- robertclaus 1y ago
  Ya, hard to know how to react without more information.
- requilence 1y ago
  In one of the responses, it provided the financial analysis of a not well-known company with a non-Latin name located in a small country. I found this company; it is real and numbers in the response are real. When I asked my ChatGPT to provide a financial report for this company without using web tools, it responded: `Unfortunately, I don’t have specific financial statements for “xxx” for 2021 and 2022 in my training data, and since you’ve asked not to use web search, I can’t pull them live.`.
  - krainboltgreene 1y ago
    I’m struggling to understand why you are so adamant that this is proof.
  - Xx_crazy420_xX 1y ago
    Did you try to ask it to provide data of the company, by explicitly invoking hallucination in the model? Right now there is no real proof, untill you confirm that the data it provided cannot be hallucinated (which could be not feisable). Also, acknowledging the response fron OpenAI staff dismissing it, would you mind sharing PoC?
deleted 1y ago
[deleted]
robswc 1y ago
Reminds me of a time I found a serious issue with mailgun. Messaged them, no reply. Had to spam their twitter to get a response. Basically you could have stolen tons of API keys from users without their knowledge and mailgun never disclosed it. I could have actually gone to their office in person if I wanted to be pedantic but it actually seemed like a pretty weird office space lol.
- tptacek 1y ago
  I don't think disclosure of reported security issues is really a norm, unless the firm finds evidence the bug was exploited (by someone other than the reporter). It's a good thing to do, but I think the majority of stuff that gets reported everywhere is never disclosed --- with the major and obvious exception of consumer or commercial software that needs to be updated "on prem".
  - robswc 1y ago
    Makes sense. The problem I have with it is that there's no way they could have determined if an API key was stolen or not, even to this day. Basically, their docs (which seemed auto-generated) pointed to a domain they did not own (verified this). So if you ran any API examples you sent your keys to a 3rd party. I know because I did this. There's no way to know that the domain in the docs is simply wrong. I tried explaining this to the support people, that I needed to talk with a software engineer but they kept stonewalling. I think it was fixed after 24 hours or so.
ajdude 1y ago
> I am issuing this limited, non‑technical disclosure: > No exploit code, proof‑of‑concept, or reproduction steps are included here. Then why bother? I feel a bit cynical here, but if the goal is to get this fixed, they're not going to care unless it becomes a zero day and is given to the masses, otherwise it's going to quietly be exploitable by the few unsavory groups who know of it and will never be patched. Isn't the whole point of responsible disclosures to give them a time clock to get this situated before actual publication? Forgive me if I'm wrong, I haven't been in that field in a long time.
- tptacek 1y ago
  This is the security equivalent of getting Google support by getting something to the top of HN. The real audience for this post is OpenAI, not you.
- lyu07282 1y ago
  It adds some pressure, we know now what the bug is about so we can guess which endpoints to poke at, then it's only a matter of time before it leaks. It would be unethical for the researcher to just publish it.
Eduard 1y ago
POC?
Eduard 1y ago
> PGP Key: 1234 5678 9ABC DEF0 1234 5678 9ABC DEF0 1234 5678 For real? At least doesn't match the one on https://keybase.io/requilence https://keybase.io/requilence
winstonhowes 1y ago
Hi all, I work on security at OpenAI. We have looked into this report and the model response does not contain outputs from any other users nor does it reflect a security vulnerability, compromise, or exploit. The original report was that submitting a message close to (but not quite) 1500 seconds to the audio transcription API would result in weird, unrelated, off-topic responses that look like they might be replies to someone else’s query. This is not what’s happening. Our API has a bug where if the tokenization of the audio (which is not strictly correlated with the audio length) exceeds a limit, the entire input is truncated, and the model effectively receives a blank query. We’re working with our API team to get this fixed and to produce more useful error messages. When the model receives an empty query, it generates a response by selecting one random token, then another (which is influenced by the first token), and another, and so on until it has completed a reply. It might seem odd that the responses are coherent, but this is a feature of how all LLM's work - each token that comes before influences the probability for the next token, and so the model generates a response containing words, phrases, code, etc. in a way that appears humanlike but in fact is solely a creation of the model. It’s just that in this case, the output started in a random (but likely) place and the responses were generated without any input. Our text models display the same behavior if you send an empty query, or you can try it yourself by directly sampling an open source model without any inputs. We took a while to respond to this. Our goal is to provide a reasonable response to reports. If you have found a security vulnerability, we encourage you to report it via our bug bounty program: https://bugcrowd.com/engagements/openai https://bugcrowd.com/engagements/openai.
- deleted 1y ago
  [deleted]
- deleted 1y ago
  [deleted]
- diggan 1y ago
  > If you have found a security vulnerability, we encourage you to report it via our bug bounty program It seems like reporting bugs/issues via that program forces you to sign a permanent NDA preventing disclosures after the reported issue been fixed. I'm guessing the author of this disclosure isn't the only one that avoided it because of the NDA. Is that potentially something you can reconsider? Otherwise you'll probably continue to see people disclosing these things publicly and as a OpenAI user it sounds like a troublesome approach.

221 points by requilence 1y ago

Reported a flaw to OpenAI that lets users peek at others' chat responses. Got an auto-reply on May 29th, radio silence since. Issue remains unpatched :( Avoided their bug bounty due to permanent NDAs preventing disclosure even after fixes. Following standard 45-day disclosure window—users should avoid sharing sensitive data until this is resolved.

fcpguru 1y ago
well done, sounds very reasonable and following the rules.
- requilence 1y ago
  Appreciate it. Just trying to do the right thing by both OpenAI and users here.
poniko 1y ago
The NDA part feels really murky.
- tptacek 1y ago
  It's pretty standard for bounty programs. If you don't like it, which is reasonable, do what this researcher did and just post independently.
  - pyman 1y ago
    The bug bounty world is a funny one. I remember one complaining that their bug was dismissed and fixed after they signed an NDA, no payout, nothing. Another one got $100 instead of $5,000 because the company downgraded the severity from high to low. So they ended up with little or no money, and no recognition either. Not sure if these were edge cases, but it does make you wonder how fair the process really is.
    - tptacek 1y ago
      If you're dealing with large companies, a good rule of thumb is that the bounty program is incentivized to pay you out. Their internal metrics improve the more they pay; the point is to turn up interesting bugs, and the figure of merit for that is "how much did we have to spend". At a large company, a bounty that isn't paying anything out is a failure. All bets are off with small random startups that do bug bounties because they think they're supposed to (most companies should not run bounties). But that's not OpenAI. Dave Aitel works at OpenAI. They're not trying to stiff you. Simultaneous discovery (either with other researchers or, even more often, with internal assessments) is super common. What's more, you're not going to get any corroboration or context for them (sets up a crazy bad incentive with bounty seekers, who litigate bounty results endlessly). When you get a weird and unfair-seeming response to a bounty from a big tech company, for the sake of your own sanity (and because you'll probably be right), just assume someone internal found the bug before you did, and you reported it in the (sometimes long) window during which they were fixing it.
      - pyman 1y ago
        Interesting insights, thanks for sharing
  - asadotzler 1y ago
    That's an exaggeration. Most industry leaders do not require NDAs, only coordinated disclosure. Mozilla's program, which has been around longer than most, doesn't. Google and Microsoft don't. Meta and Apple don't. This is water carrying, intentional or not, for a terrible practice that should be shamed, so that it doesn't become standard.
    - tptacek 1y ago
      My understanding is that all Bugcrowd bounties do by default. You can shame it all you want, but you can also just publish your bugs directly. Nobody has to use the Bugcrowd platform. You don't even have to wait 45 days; I don't buy these "CERT/CC" rules.
      - asadotzler 1y ago
        You said it was pretty standard for bug bounty programs, and I disagreed pointing to several of the largest and longest lived bug bounty programs, none of which do that, and your response is pointing out that one particular platform does it? Even among 3rd party platforms, of which there are several bigs, the NDAs are not a platform requirement, just an option for participating firms. NDAs are not the norm. Don't mislead people who would otherwise get into this game with non-issues they need not worry over.
        tptacek 1y ago
        OpenAI's security team commented on the thread themselves that they believe they simply accepted the Bugcrowd defaults. I think you're trying to find a controversy that just isn't here.
jonrouach 1y ago
you're sure it's not their "feature" that calling the api with empty string returns random hallucinations? https://jarbon.medium.com/gpt-prompt-bug-94322a96c574 https://jarbon.medium.com/gpt-prompt-bug-94322a96c574
- requilence 1y ago
  No, definitely not the empty string hallucination bug. These are clearly real user conversations. They start like proper replies to requests, sometimes reference the original question, and appear in different languages.
  - JyB 1y ago
    I don’t see anything here that would prevent a LLM from generating these. Right?
    - requilence 1y ago
      In one of the responses, it provided the financial analysis of a not well-known company with a non-Latin name located in a small country. I found this company; it is real and numbers in the response are real. When I asked my ChatGPT to provide a financial report for this company without using web tools, it responded: `Unfortunately, I don’t have specific financial statements for “xxx” for 2021 and 2022 in my training data, and since you’ve asked not to use web search, I can’t pull them live.`.
      - Sebguer 1y ago
        Do you understand what a hallucination is?
        jojobas 1y ago
        Coming up with accurate financial data that you can't get it to report outright doesn't seem like one.
maxlin 1y ago
Permanent NDA's? Oof. It's like their plan is to just try to force the lid down till they reach ASI or something lol
- tptacek 1y ago
  Again: NDAs are bog standard bounty terms.
999900000999 1y ago
Users should always avoid sharing sensitive data. A lot of AI products straight up have plan text logs available for everyone at the company to view.
- ameliaquining 1y ago
  Which ones? Do you just mean tiny startups and side projects and the like or is this a problem that major model providers have?
- pyman 1y ago
  It's not just about sensitive data like passwords, contracts, or IP. It's also about the personal conversations people have with ChatGPT. Some are depressed, some are dealing with bullying, others are trying to figure out how to come out to their parents. For them, this isn't just sensitive, it's life-changing if it gets leaked. It's like Meta leaking their WhatsApp messages. I really hope they fix this bug and start taking security more seriously. Trust is everything.
  - milkshakes 1y ago
    maybe you should stop trusting random people on the internet making extraordinary claims without proof then?
    - baby_souffle 1y ago
      Isn't "assume vulnerable" The only prudent thing to do here?
      - refulgentis 1y ago
        No? Yes? Mu? After some hemming and hawing, my most cromulent thought is, having good security posture isn't synonymous with accepting every claim you get from the firehose
      - milkshakes 1y ago
com2kid 1y ago
I see other users conversations on my Gemini dashboard, not sure who to even complain to. Software quality is... Minimal now days.
deleted 1y ago
[deleted]

novia 1y ago

https://archive.is/mYehH https://archive.is/mYehH

JyB 1y ago

I believe it is extremely important to disclose that the ‘responses leaks’ you obtained did not originate from LLM models themselves, but rather through other insecure systems / in a more conventional manner. Just to avoid yet another case of hallucinations outputs getting misinterpreted.

requilence 1y ago
Right, thank you for the suggestion. Just added a paragraph to the original blog post.
- tabletcorry 1y ago
  Your added paragraph appears to suggest the opposite, that this was an LLM response. Was the "leaked data" a response from an LLM directly?
  - JyB 1y ago
    Yes apparently which makes this report pretty flimsy.
    - tptacek 1y ago
      Upthread, OpenAI's security team confirms it's a false report; it's a variant of the empty-prompt hallucination.
      - JyB 1y ago
        Incredible that so many people still don't understand what an LLM is. Especially ones that you would expect to grasp it.

pyman 1y ago

> A single misconfiguration can leak thousands of sensitive conversations in seconds. Treating privacy as an afterthought is untenable when the blast radius is this large. Massive security bug, well spotted. It's like Bank of America showing other people my transactions, or Meta leaking my WhatsApp messages. This raises some serious questions about security.

jofzar 1y ago

I'm curious which mailbox they sent to, trying to find a mailbox is surprisingly hard even with my Google searching.

requilence 1y ago
they have security.txt file on their domain and mentioned it in some other place

blibble 1y ago

good to see more and more hackers refusing to use corporate bug bounty platforms with onerous terms I certainly wouldn't sign an indefinite NDA for a chance to win: Average payout: $836.36 openai should be grateful, after all, they want all information to be free

rglover 1y ago

Thank you for sharing and reporting this.

thorum 1y ago

> The leaked responses show clear signs of being real conversations: they start with contextually appropriate replies, sometimes reference the original user question, appear in various languages, and maintain coherent conversational flow. This pattern is inconsistent with random model hallucinations but matches exactly what you'd expect from misdirected user sessions. A model like GPT-4o can hallucinated responses that are indistinguishable from real user interactions. This is easy to confirm for yourself: just ask it to make one up. I’m certainly willing to believe OpenAI leaks real user messages, but this is not proof of that claim.

robertclaus 1y ago
Ya, hard to know how to react without more information.
requilence 1y ago
In one of the responses, it provided the financial analysis of a not well-known company with a non-Latin name located in a small country. I found this company; it is real and numbers in the response are real. When I asked my ChatGPT to provide a financial report for this company without using web tools, it responded: `Unfortunately, I don’t have specific financial statements for “xxx” for 2021 and 2022 in my training data, and since you’ve asked not to use web search, I can’t pull them live.`.
- krainboltgreene 1y ago
  I’m struggling to understand why you are so adamant that this is proof.
- Xx_crazy420_xX 1y ago
  Did you try to ask it to provide data of the company, by explicitly invoking hallucination in the model? Right now there is no real proof, untill you confirm that the data it provided cannot be hallucinated (which could be not feisable). Also, acknowledging the response fron OpenAI staff dismissing it, would you mind sharing PoC?

deleted 1y ago

[deleted]

robswc 1y ago

Reminds me of a time I found a serious issue with mailgun. Messaged them, no reply. Had to spam their twitter to get a response. Basically you could have stolen tons of API keys from users without their knowledge and mailgun never disclosed it. I could have actually gone to their office in person if I wanted to be pedantic but it actually seemed like a pretty weird office space lol.

tptacek 1y ago
I don't think disclosure of reported security issues is really a norm, unless the firm finds evidence the bug was exploited (by someone other than the reporter). It's a good thing to do, but I think the majority of stuff that gets reported everywhere is never disclosed --- with the major and obvious exception of consumer or commercial software that needs to be updated "on prem".
- robswc 1y ago
  Makes sense. The problem I have with it is that there's no way they could have determined if an API key was stolen or not, even to this day. Basically, their docs (which seemed auto-generated) pointed to a domain they did not own (verified this). So if you ran any API examples you sent your keys to a 3rd party. I know because I did this. There's no way to know that the domain in the docs is simply wrong. I tried explaining this to the support people, that I needed to talk with a software engineer but they kept stonewalling. I think it was fixed after 24 hours or so.

ajdude 1y ago

> I am issuing this limited, non‑technical disclosure: > No exploit code, proof‑of‑concept, or reproduction steps are included here. Then why bother? I feel a bit cynical here, but if the goal is to get this fixed, they're not going to care unless it becomes a zero day and is given to the masses, otherwise it's going to quietly be exploitable by the few unsavory groups who know of it and will never be patched. Isn't the whole point of responsible disclosures to give them a time clock to get this situated before actual publication? Forgive me if I'm wrong, I haven't been in that field in a long time.

tptacek 1y ago
This is the security equivalent of getting Google support by getting something to the top of HN. The real audience for this post is OpenAI, not you.
lyu07282 1y ago
It adds some pressure, we know now what the bug is about so we can guess which endpoints to poke at, then it's only a matter of time before it leaks. It would be unethical for the researcher to just publish it.

Eduard 1y ago

POC?

Eduard 1y ago

> PGP Key: 1234 5678 9ABC DEF0 1234 5678 9ABC DEF0 1234 5678 For real? At least doesn't match the one on https://keybase.io/requilence https://keybase.io/requilence

winstonhowes 1y ago

Hi all, I work on security at OpenAI. We have looked into this report and the model response does not contain outputs from any other users nor does it reflect a security vulnerability, compromise, or exploit. The original report was that submitting a message close to (but not quite) 1500 seconds to the audio transcription API would result in weird, unrelated, off-topic responses that look like they might be replies to someone else’s query. This is not what’s happening. Our API has a bug where if the tokenization of the audio (which is not strictly correlated with the audio length) exceeds a limit, the entire input is truncated, and the model effectively receives a blank query. We’re working with our API team to get this fixed and to produce more useful error messages. When the model receives an empty query, it generates a response by selecting one random token, then another (which is influenced by the first token), and another, and so on until it has completed a reply. It might seem odd that the responses are coherent, but this is a feature of how all LLM's work - each token that comes before influences the probability for the next token, and so the model generates a response containing words, phrases, code, etc. in a way that appears humanlike but in fact is solely a creation of the model. It’s just that in this case, the output started in a random (but likely) place and the responses were generated without any input. Our text models display the same behavior if you send an empty query, or you can try it yourself by directly sampling an open source model without any inputs. We took a while to respond to this. Our goal is to provide a reasonable response to reports. If you have found a security vulnerability, we encourage you to report it via our bug bounty program: https://bugcrowd.com/engagements/openai https://bugcrowd.com/engagements/openai.

deleted 1y ago
[deleted]
deleted 1y ago
[deleted]
diggan 1y ago
> If you have found a security vulnerability, we encourage you to report it via our bug bounty program It seems like reporting bugs/issues via that program forces you to sign a permanent NDA preventing disclosures after the reported issue been fixed. I'm guessing the author of this disclosure isn't the only one that avoided it because of the NDA. Is that potentially something you can reconsider? Otherwise you'll probably continue to see people disclosing these things publicly and as a OpenAI user it sounds like a troublesome approach.