OpenAI has launched a bounty program for discovering vulnerabilities in its APIs, in which included the popular chatbot ChatGPT, and offers a bounty of up to $20,000, reports The Verge.
The program encourages users to actively search for vulnerabilities in OpenAI artificial intelligence services. Meanwhile, discovery rewards range from $200 for “low-severity findings” to $20,000 for “exceptional discoveries.” Vulnerability reports can be submitted through the cybersecurity crowdsourcing platform Bugcrowd.
However, it is important to note that the OpenAI bug bounty program excludes rewards for jailbreaking ChatGPT or for generating malicious code or text. OpenAI’s Bugcrowd page clearly states that “issues related to the content of model prompts and responses are strictly out of scope, and will not be rewarded.” Hacking ChatGPT typically involves injecting complex scripts into the system to bypass security filters, allowing the chatbot to generate prohibited responses such as hate speech or instructions for making weapons.
OpenAI recognizes that addressing the security issues of generative models is complex and requires a broader approach, as these are not isolated bugs that can be directly fixed. As a result, reports related to model security issues should be submitted via the OpenAI’s feedback page, not through the bug bounty program.
While jailbreaks and other vulnerabilities highlight the potential risks and problems associated with AI systems, they may not pose an immediate threat to OpenAI’s security infrastructure. For example, in a recent incident, a hacker known as rez0 exposed 80 “secret plugins” for the ChatGPT API, which were not yet released or had the status of experimental add-ons for the chatbot. OpenAI patched the vulnerability within a day of rez0 reporting it on Twitter, demonstrating a swift response to the security issue.