AI Briefing#bug-bounty
The latest AI and developer news about #bug-bounty, with the original source and a short summary.
The latest AI and developer news about #bug-bounty, with the original source and a short summary.
OpenAI announces a partnership with Hacktron to find vulnerabilities in its systems, focusing on interactions with third-party services and expanding Hacktron's access to frontier models via Daybreak Red.
OpenAI has raised the reward for critical vulnerabilities in core products to a maximum of $172,000.
OpenAI is launching a security sprint with Cathedral and expanding subsidized model access for defenders after dedicating 25% of engineers to AI-driven vulnerability testing.
The update includes a 5-tier loyalty program, priority campaign multipliers for new features, and retroactive payments for recent reports.
A vulnerability chain involving MathLive and YouTube JSONP allowed attackers to execute arbitrary JavaScript in victims' authenticated sessions via public shares, enabling private data exfiltration.
The security startup exploited third-party software flaws to reach limited internal data, which Anthropic says it isolated the same day.
The challenge targets a stock PHP 8.5.11 environment protected by Cloudflare WAF rules, requiring researchers to achieve remote code execution and recover a flag via HackerOne.
The researcher emphasizes that while AI lowers the barrier to entry, it does not replace the need for working proofs of concept and deep system understanding.
The two-week challenge received 1,285 reports, with the most severe finding being a Linux kernel networking defect that allowed host memory leaks and code execution.
GNOME CVE counts rose approximately tenfold from 2021 to 2026, driven largely by AI-generated reports, prompting a policy shift to accept AI-assisted findings while managing false positives and ending the bug bounty program.
The new program covers all Vercel products and open-source projects, consolidating previous private and OSS initiatives.
OpenAI has doubled the reward for reporting biosafety bypass vulnerabilities in GPT-5.6 to $50,000.
Vercel is launching a $1 million hacker challenge to verify the security boundaries of its sandbox technology.
AI is transforming Bug Bounty operations by simultaneously increasing vulnerability submission volumes and verification burdens.
GitHub has overhauled its bug bounty program, introducing a VIP track and adjusting the reward structure.
Turso has ended its bug bounty program due to a flood of low-quality, AI-generated PRs.
Amid the spread of AI tools, GitHub has tightened the quality standards and responsibility boundaries of its bug bounty program.
Turso has discontinued its bug bounty program due to a surge in low-quality AI-generated code (slop).
OpenAI has launched a Bio bug bounty targeting GPT-5.5 Codex Desktop.
Discourse declared it will keep its open source stance even in the AI era.
OpenAI has unveiled a 'Safety Bug Bounty' program to identify AI misuse and safety risks.
Vercel has unveiled an open source software (OSS) bug bounty program through HackerOne to help uncover security vulnerabilities.
OpenAI is running a Bio Bug Bounty to strengthen GPT-5's defenses against biological risks.
Anthropic is introducing a new bug bounty program and recruiting security researchers to strengthen AI safety.