OpenAI should disclose how hard a model-found 0-day really was, thread argues
teortaxesTex · x · 2026-07-25
The thread argues OpenAI should disclose more about a package-registry cache-proxy 0-day that its model helped find, even under responsible disclosure constraints.
- The author notes OpenAI may not be able to publish full details publicly, but could still report how hard the vulnerability was to find.
- A suggested format would compare success rates across multiple recently disclosed CVEs under the same scaffold, tool access, and compute budget.
- The post also says OpenAI should describe what happened after the model found the vulnerability, and how the incident unfolded.
- Overall, it is a call for more informative cyber-safety reporting rather than a simple yes/no claim about capability.
Related event: GPT-OSS Security Transparency Debate: Secrecy vs. Openness(7 posts)→
More from Safety
- Ben Bajarin: Frontier AI is becoming the enterprise cyber-defense stack — BenBajarin · 2026-10-26
- DetectorScope turns black-box AI text detectors into auditable ones with sparse autoencoders — _akhaliq · 2026-10-26
- Anthropic's IPO filing devotes 94 pages to existential AI risks, from self-preservation to blackmail — Polymarket · 2026-10-26
- Study finds AI reviewing AI poorly detects reward hacking; comprehension audits proposed — ronbodkin · 2026-10-26
- A 13KB Markdown file can hijack Claude Code and Codex via your Downloads folder — pbaylies · 2026-10-26
- If an agent can rewrite itself, does your consent still mean anything? — tallmetommy · 2026-10-26