OpenAI bug disclosure sparks CFAA debate as researcher defends good-faith repo access test
ns123abc · x · 2026-09-21
A security researcher details how their team responsibly disclosed a Codex on cloud repo-access bug—proving access with a harmless PR and deliberately avoiding sensitive data—only to face an angry CISO who invoked potential CFAA violations and authorization-boundary disputes.
The researcher argues CISOs are right to investigate but wrong to treat good-faith, minimally-invasive researchers as adversaries. Alex Stamos pushes back, citing the Sullivan case and misprision of felony to explain why OpenAI demanded detailed logs, claiming bug bounty participants have been spoiled by lax CFAA enforcement. The exchange exposes a rule vacuum between AI companies' security teams and the traditional bug bounty ecosystem.
More from Safety
- Safety researchers blast OpenAI/Anthropic plan: automating alignment research with possibly misaligned AI — trevposts · 2026-11-12
- OpenAI finds models are getting harder to monitor through their chain-of-thought — xiamengzhou · 2026-11-12
- New York's RAISE Act takes effect, forcing OpenAI and Anthropic to register and report incidents — emmanuelvivier · 2026-11-12
- Gemini won't let you keep chat history while opting out of AI training — Google bundles both into one setting — arshdeep · 2026-11-12
- French public WiFi warning: torrent piracy could cost you EUR 7,500 — michalmalewicz · 2026-11-12
- Dan Robinson flags contradiction: China race rhetoric vs loosening GPU export controls — Puzzleheaded-King584 · 2026-11-12