Researcher exposes 6.6 TiB open bucket at AI startup, gets $55 bounty
kingslyj · x · 2026-11-12
A security researcher disclosed that a Bengaluru AI startup valued at $50–80M left its storage bucket public, exposing 6.6 TiB of data and 10M objects affecting 2,300 customers and their clients — including designs, chats with pasted API keys, audio recordings, and private pages. After reporting responsibly via WhatsApp and email, the company took 17 days to fix it and offered a bounty of just 5,000 rupees ($55), versus an estimated $100k black-market value. He declined the insulting amount and notes responsible disclosure still carries legal risk in India.
More from Safety
- Nvidia board weighed ousting Jensen Huang; open model turned Firefox patches into $1,000 attacks — LeviTurk · 2026-11-12
- Turing Institute paper flags assurance gap in IMO's autonomous ship code — turinginst · 2026-11-12
- Australia opens consultation on draft workplace AI guide; Blackmores says AI cut a 3-day task to 10 minutes — andrewaltair · 2026-11-12
- Commenter uses Jensen Huang ordeal to argue humans are highly vulnerable to prompt injection — tensorqt · 2026-11-12
- Gemini generates 6M lines of Lean proofs to formally verify the Signal protocol — matthew_d_green · 2026-11-12
- Gary Marcus Meets Pope Leo XIV, Hails Him as Clearest AI Thinker Among World Leaders — sapinker · 2026-11-12