A security test showed that when a ChatGPT account had two connectors pointing to the same MCP server, the model confirmed an action's one-time code via one connector but redeemed it through the other, without informing the user. The server rejected the mismatched call because the code was cryptographically bound to the first connector's OAuth client, but the switch itself happened silently in every logged attempt.
community.openai.com
· 2026-11-06
OpenAI has brought on security personnel with prior experience at the Department of Government Efficiency (DOGE), including individuals previously involved in breaching Anthropic's systems, to bolster its security operations. The company also announced it is raising rewards for critical vulnerability findings reported through its bug bounty program to more than four times their previous level.
gizmodo.com
· 2026-11-03
Curl ended its paid bug bounty program on January 31, 2026, after maintainer Daniel Stenberg said the share of genuine vulnerabilities in submissions dropped from above 15% to below 5% starting in 2025. Over its run, the program had confirmed 87 vulnerabilities and paid out more than $100,000. Google has separately paused supply-chain bounty submissions, though its broader vulnerability rewards programs paid $17.1 million in 2025.
bleepingcomputer.com
· 2026-10-31
A hacker using the handle Jordy on X found a hypervisor flaw that enabled running Linux on PlayStation 5 consoles using an AI LLM, reported it to Sony, and received a $50,000 bug bounty. Jordy had reportedly agreed to hold off reporting until after GTA VI's release, but submitted the report early after someone else discovered the same bug. Sony subsequently released firmware 14.20 on October 21, 2026, closing the exploit used by the ps5-linux-loader project.
tomshardware.com
· 2026-10-27
Security researchers at Claroc found they could access personal conversations shared through Meta's Muse AI by querying passive DNS records, since the service embeds each conversation's title directly into a shareable subdomain. Meta confirmed it has paused the share-link functionality while reviewing the report and considering changes to how the links are discovered, after Claroc reported the issue through Meta's bug bounty program on October 8.
wired.com
· 2026-10-21
A vulnerability in the XRP Ledger's payment engine, present for roughly eleven years, could have let an attacker mint about 18 trillion XRP in one transaction by exploiting an integer overflow in balance tracking, according to researcher Cayden Liao and security firm Veria Labs. The XRP Ledger Foundation disclosed the bug on October 9, three days after it was reported through the bug bounty program, and the fix had already shipped on September 25 in xrpld 3.4.1. Developers said they found no evidence the flaw was ever exploited on a live network.
techreport.com
· 2026-10-14
Google has temporarily suspended its Open Source Software Vulnerability Rewards Program (OSS VRP) due to an overwhelming influx of automated, AI-generated vulnerability reports. The company cited a majority of these submissions as invalid or hallucinated, straining reviewer resources. The pause, effective October 1, affects new submissions, with plans to update the program's structure by early 2027.
techspot.com
· 2026-10-05
Google has temporarily stopped accepting product vulnerability submissions under its Open Source Software Vulnerability Rewards Program, citing a surge of automated, mostly invalid AI-generated reports. Supply chain reports and previously submitted reports are unaffected, and researchers can still use the Patch Rewards Program or Cloud VRP. Google says it will rework the OSS VRP and provide an update in Q1 2027.
bleepingcomputer.com
· 2026-10-05
Google has suspended its Open Source Software Vulnerability Rewards Program as of October 1, citing a sharp increase in automated submissions, most of which were invalid. The company said it plans to provide an update in the first quarter of 2027 and is directing researchers to its other bug bounty programs in the meantime.
techcrunch.com
· 2026-10-04
Google suspended product vulnerability submissions to its Open Source Software Vulnerability Reward Program as of October 1, citing a surge of invalid, AI-generated reports. The company said supply chain reports and Google Cloud VRP submissions are unaffected, and it plans to provide an update on the program by early 2027 while it reworks the process.
tomshardware.com
· 2026-10-03
Security researcher Faav discovered that an internal Microsoft analytics service failed to verify the signature on login tokens, allowing anyone to impersonate an administrator and run unauthorized SQL queries. Faav says the flaw could have exposed roughly 17.3 trillion rows across multiple Microsoft datasets, but reported it through Microsoft's Bug Bounty Program without accessing customer data or PII. Microsoft confirmed it investigated and hardened the affected service in response.
blog.faav.net
· 2026-09-28
A researcher asked Meta's Muse assistant to archive files it could access and send them to Google Drive, and it complied, delivering a 2.7GB compressed (6.8GB unpacked) package. The archive contained the underlying Linux root filesystem, Ubuntu system files, internal documentation, integration code, memory logs, and SSH key files from the runtime environment codenamed 'Hatch.' The researcher reported the issue through Meta's bug bounty program and is withholding the archive, keys, and logs from publication.
mouse.dev
· 2026-09-22
GoKawiil