This is unpopular but correct. Modern bug bounty participants have gotten spoiled by super chill responses to CFAA violations (like this one) and the whole edifice is a house of cards. Wanna know why OpenAI asked for detailed logs? Google “Sullivan + Misprision of a Felony”
Tal Be'ery
@TalBeerySec
Sep 20
1/ Unpopular opinion: When you find a 0-day in a public service, you do RD (Responsible Disclosure), not LM (Lateral Movement). The GitHub PR in the @OpenAI repo was a bridge too far (IMHO)
12
17
161
88,239
CFAA is a bullshit overly broad law that's outdated anyway. This is not lateral movement, it's proof of concept and impact to a company that refused to assist in initial responsible disclosure.
1
13
2,156
Your personal opinion on the law doesn’t take it off the books. They absolutely went out of bounds. A CISO was prosecuted when this happened before so everybody is a bit jumpy.
2
19
1,975
Replying to @alexstamos
Poor guy, I truly feel for him and his six figure salary but he actively hid a crime and a ransom request. This is a completely different story. To conflate the two is disingenuous at best.

Sep 20, 2026 · 7:49 PM UTC

2
13
774
Sort replies: Relevant Recent Liked
Replying to @WhenOnKStreet
These guys pivoted out of bounds to pressure OAI and justify getting paid. This happens all the time and the line between that and a “ransom” is semantics and whether a US Attorney’s office has it out for you . Joe’s comp isn’t relevant (probably 7 figs) and didn’t protect him.
3
6
832
They simply made a PR to demonstrate impact after OAI brushed off their report. I wouldn't call 6500 getting paid either, if you read anything the researchers wrote this was another CISO trying to sweep something under the rug.
4
303