[syl5x]

Welp, I reported a lot of AI prompt-injection bugs to various organizations, even some leading to RCE. They would say that they won't consider it as a bug, silently fix it and you are left there doing the work for free. I won't say "do not report stuff" but what's the point when companies are treating people like that, the incentive of finding and reporting bugs is literally zero nowadays.

[a34729t]

Just post these on 4chan. That's the fastest way for the issues to get attention both good and bad and get a fix in as fast as possible.

[chii]

> They would say that they won't consider it as a bug, silently fix it and you are left there doing the work for free.

then as long as you have a trail that proves you discovered and reported it, you can make this a PR nightmare for them with noise about it publicly. The fact that it is fixed means it is considered an issue, and so by declining to acknowledge the issue and refusing to pay, they're essentially deleting the built-up trust of a bug bounty.

It won't pay out even if you did this of course, but if this happens a lot, the aggregate reputational damage leads to "do not report". That's really the only outcome you can engineer, but it is decently damaging that google _should_ see and prevent it.