Security Row: Was the 0-Day PR in OpenAI's GitHub Repo Responsible Disclosure or a Bridge Too Far?
joshua_saxe · x · 2026-09-21
- Security researcher Tal BeerySec argues that when you find a 0-day in a public service, you do responsible disclosure, not lateral movement — calling the PR submitted in @OpenAI's GitHub repo "a bridge too far."
- joshuasaxe counters: right on rules, wrong on public interest. He says now is exactly the time for dramatic wake-up calls about weights security, algorithmic secrets security, and user data security, and is glad HacktronAI did what they did.
- The exchange highlights a real split in the AI security community over where white-hat boundaries lie when AI giants' core assets are at stake.
More from Safety
- Safety researchers blast OpenAI/Anthropic plan: automating alignment research with possibly misaligned AI — trevposts · 2026-11-12
- OpenAI finds models are getting harder to monitor through their chain-of-thought — xiamengzhou · 2026-11-12
- New York's RAISE Act takes effect, forcing OpenAI and Anthropic to register and report incidents — emmanuelvivier · 2026-11-12
- Gemini won't let you keep chat history while opting out of AI training — Google bundles both into one setting — arshdeep · 2026-11-12
- French public WiFi warning: torrent piracy could cost you EUR 7,500 — michalmalewicz · 2026-11-12
- Dan Robinson flags contradiction: China race rhetoric vs loosening GPU export controls — Puzzleheaded-King584 · 2026-11-12