I suspect you don’t really know what you are talking about. “It pays.” is not the only reason people like doing bad things. You’re right about the movies bit though, people tend to like black and white narratives as your naive “That’s why people like doing bad things. It pays.” comment perfectly demonstrates.
Per the article, that's the price OpenAI is willing to pay for an exploit that covers any account or integration one connects to their OpenAI account. Let that sink in.
I don't think the other commenters mentioning how server-side vulnerabilities aren't as lucrative in the black market are making that connection.
This whole blog-post is impressive with the chain of vulnerabilities involved. However...
OpenAI also paid us a $6,500 bounty.
?
That amount for this payout is beyond pathetic for a near $1.2T company, who just got themselves breached with a complete potential source code leak.
This is like getting close to breaching the main monorepo at Google: google3.
If this was on the black market and the leak included unreleased models and training material, it would easily be worth tens of millions. Even reporting crypto smart contract flaw pay way more than that on average of $100k - $10M.
The unfortunate truth of doing the right thing. Also, correct me if I'm wrong but there are too many bad things out there and companies can't give 1 million bounty for stuff like that. I'm sure they could but in the long run, wouldn't it be unsustainable?
No more unsustainable than these companies already are by default. The bounty should have been proportionate to how important and pressing the findings were.
Pay next to nothing every time, accept one financially-depressed researcher sale to blackhats causing tremendous business disruption every n years. Cheaper than honest payouts to [keep] researchers [honest]? Keep paying chump change. (Booo)
...researchers found a bug in the way that the community-discussion forum Discourse processed certain image files. The researchers had access to a special version of Claude Opus 4.8...
>At first, it didn’t work. That evening, however, Anthropic released Opus 5 and by the next day, Claude had found a way to exploit the bug...
Is this speed of capability because hacking is almost entirely machine verifiable, thus training quicker/deeper than other domains?
Interestingly, the vulnerable code had been changed upstream the previous year, but the commit was not documented as a security fix and received no CVE.3 This might be a reason why Debian 12 and 13 have not received the security relevant backports in time.
Ooof, keeping packages like this up to date with the rate of updates and churn is a mess.
There was something I was hoping to find in the article, which is this common situation where employees are also the customer of their companies product, they happen to have elevated privileges and yet the credential rules applicable to those accounts are same as regular customers. This is across all the product lines, some companies do a better job than others but its still a problem that exists and gets exploited.
Unsandboxed ImageMagick is known for being a security nightmare even back when PHP ruled the world (not saying sandboxing is a panacea either, it just requires a different and potentially harder exploit to develop a full chain). Difference is it's easier than ever to turn vulnerabilities into full compromises. At some point we'll have to replace all parsers with something at least as safe as https://github.com/google/wuffs right? Otherwise ImageMagick and co. will just keep giving.
It does make me wonder how much this could be hardened by, to put it in an extremely crude way, taking the current imagemagick code base and throwing a bunch of adversarial SOTA LLMs at it to discover 'bugs' and exploits of this nature until it can be coaxed into a less dangerous state. Or even using the LLMs to fully port its functionality to a memory safe language. Would take a while to get all the changes approved and then into various distribution imagemagick packages.
I really hope those model weights are more secure than this
$6 500 bounty for this is a joke. The black market price would be smth like $6 500 000 or more
That's why people like doing bad things. It pays. Why do you think movies like using this single theme over and over again? It's always happening
I suspect you don’t really know what you are talking about. “It pays.” is not the only reason people like doing bad things. You’re right about the movies bit though, people tend to like black and white narratives as your naive “That’s why people like doing bad things. It pays.” comment perfectly demonstrates.
There is probably no black market for this at all.
https://news.ycombinator.com/item?id=43025038
Why don't they?
Okay, then first download all their sources (perhaps with model weights?) and sell that. Not the bug itself
Now you're not selling a vulnerability, you're planning a heist. That is a thing you can do!
I also thought that's crazy. Why even bother for these kind of bounties.
Per the article, that's the price OpenAI is willing to pay for an exploit that covers any account or integration one connects to their OpenAI account. Let that sink in.
I don't think the other commenters mentioning how server-side vulnerabilities aren't as lucrative in the black market are making that connection.
This whole blog-post is impressive with the chain of vulnerabilities involved. However...
?
That amount for this payout is beyond pathetic for a near $1.2T company, who just got themselves breached with a complete potential source code leak.
This is like getting close to breaching the main monorepo at Google: google3.
If this was on the black market and the leak included unreleased models and training material, it would easily be worth tens of millions. Even reporting crypto smart contract flaw pay way more than that on average of $100k - $10M.
Come on.
The unfortunate truth of doing the right thing. Also, correct me if I'm wrong but there are too many bad things out there and companies can't give 1 million bounty for stuff like that. I'm sure they could but in the long run, wouldn't it be unsustainable?
How much would a nation state pay for a complete copy of OpenAI’s github repositories? I doubt there are many full chains laying around like this.
No more unsustainable than these companies already are by default. The bounty should have been proportionate to how important and pressing the findings were.
It’s an interesting bet then.
Pay next to nothing every time, accept one financially-depressed researcher sale to blackhats causing tremendous business disruption every n years. Cheaper than honest payouts to [keep] researchers [honest]? Keep paying chump change. (Booo)
My guess is that OpenAI has done a lot more to prevent exfil of their model weights than the codebase of their main web app and client.
Is this speed of capability because hacking is almost entirely machine verifiable, thus training quicker/deeper than other domains?
Ooof, keeping packages like this up to date with the rate of updates and churn is a mess.
There was something I was hoping to find in the article, which is this common situation where employees are also the customer of their companies product, they happen to have elevated privileges and yet the credential rules applicable to those accounts are same as regular customers. This is across all the product lines, some companies do a better job than others but its still a problem that exists and gets exploited.
Unsandboxed ImageMagick is known for being a security nightmare even back when PHP ruled the world (not saying sandboxing is a panacea either, it just requires a different and potentially harder exploit to develop a full chain). Difference is it's easier than ever to turn vulnerabilities into full compromises. At some point we'll have to replace all parsers with something at least as safe as https://github.com/google/wuffs right? Otherwise ImageMagick and co. will just keep giving.
It does make me wonder how much this could be hardened by, to put it in an extremely crude way, taking the current imagemagick code base and throwing a bunch of adversarial SOTA LLMs at it to discover 'bugs' and exploits of this nature until it can be coaxed into a less dangerous state. Or even using the LLMs to fully port its functionality to a memory safe language. Would take a while to get all the changes approved and then into various distribution imagemagick packages.
They used a heif payload to get server access but they never describe the SSO flaw they used to actually get repo access (the juicy part!), bummer!
Wish they shared that interesting piece since that's the interesting part.
Also pretty shocking that openai uses github. I would have expected a company of that size with that much to lose would be using self hosted stuff.
agreed… why can an ID token for a separate client application be used to read and write to GitHub? that’s the story here.
Interesting that Claude agreed to assist in crafting this exploit. Don’t these models usually reject such requests?
You ask it differently. One could call this "prompt hacking", even.