This is unpopular but correct. Modern bug bounty participants have gotten spoiled by super chill responses to CFAA violations (like this one) and the whole edifice is a house of cards. Wanna know why OpenAI asked for detailed logs? Google “Sullivan + Misprision of a Felony”
Tal Be'ery
@TalBeerySec
Sep 20
1/ Unpopular opinion: When you find a 0-day in a public service, you do RD (Responsible Disclosure), not LM (Lateral Movement). The GitHub PR in the @OpenAI repo was a bridge too far (IMHO)
12
17
161
88,238
CFAA is a bullshit overly broad law that's outdated anyway. This is not lateral movement, it's proof of concept and impact to a company that refused to assist in initial responsible disclosure.
1
13
2,156
Your personal opinion on the law doesn’t take it off the books. They absolutely went out of bounds. A CISO was prosecuted when this happened before so everybody is a bit jumpy.
2
19
1,975
Poor guy, I truly feel for him and his six figure salary but he actively hid a crime and a ransom request. This is a completely different story. To conflate the two is disingenuous at best.
2
13
773
These guys pivoted out of bounds to pressure OAI and justify getting paid. This happens all the time and the line between that and a “ransom” is semantics and whether a US Attorney’s office has it out for you . Joe’s comp isn’t relevant (probably 7 figs) and didn’t protect him.
3
6
832
Replying to @alexstamos @WhenOnKStreet
it’s incredibly sad that you interpret this as asking for ransom like we are some poor beggars. is that how you look down on everyone? fwiw, i rather want my research to go out and read by peers than getting shut up by 100k bounty for a cool bug like the openai one.
s1r1us
@S1r1u5_
24 Oct 2025
mutual disclosure policy is decadent and against the spirit of hacker culture. essentially a puppet to vendor, they can treat you like shit and you won't be able to disclose even a ounce of the detail. fuck bounties and shitty disclosure policies on h1/bc and drop bugs to security@ with p0 disclosure policy. win-win either way and you are in control of your research and sweat, if shit goes south -- name and shame. > This bug is subject to a 90 day disclosure deadline. If a fix for this issue is made available to users before the end of the 90-day deadline, this bug report will become public 30 days after the fix was made available. Otherwise, this bug report will become public at the deadline. More details on the policy: htxps://about.google/company-info/appsecurity/.

Sep 20, 2026 · 9:34 PM UTC

1
1
30
3,240
Sort replies: Relevant Recent Liked
Replying to @S1r1u5_ @rootxharsh @alexstamos @WhenOnKStreet
@grok how does the ciso comparison make sense to this case? The CISO hid the fact that he paid 100k ransom to threat actors, the case here was responsible disclosure with proven impact to be scored as critical - who is right?
1
5
541