Teen researcher: AI bug denied, later fixed without credit

Posted by Anh_khoa on Wednesday September 10, 2025 @02:43AM
from the self-post dept.

I’m 14, based in Vietnam, and in July I discovered a vulnerability that exposed the system prompt of a major AI model. I responsibly reported it via the official bug bounty program. Response: “Out of scope, just an AI issue.”

Weeks later, I checked again — the bug had been quietly patched. No acknowledgment, no credit.

If it’s “not a bug,” why fix it? And if it’s fixed, why dismiss the report?

Sharing here to hear thoughts from the security community.

( 2 comments | 4 points | on HN )

Re:Teen researcher: AI bug denied, later fixed without credit by thankIsrael on Wednesday September 10, 2025 @03:13AM (#45194294)

If it is fixed, you can tell us what the bug is here. If your bug is just typing a prompt, than what you probably experienced is hallucination, and the hallucination has now been rectified.

[ Parent | on HN ]

Re:Teen researcher: AI bug denied, later fixed without credit by yorwba on Wednesday September 10, 2025 @05:00AM (#45195092)

"Out of scope" doesn't mean it's not a bug, it means that it's not the kind of bug they pay bounties for. You'll need to read the fine print of the bug bounty program to find out which bugs are eligible and which are out of scope.

[ Parent | on HN ]