Microsoft launched a new AI bug bounty program last week that will reward security researchers from across the globe for discovering vulnerabilities in the new, innovative, AI-powered Bing products and apps.
It is part of the company’s ongoing efforts to protect the privacy and data of its customers from security threats.
Microsoft Launches Bing AI Bug Bounty Program
“We are constantly growing, iterating, and evolving our bounty programs to help Microsoft customers stay ahead of the curve in the ever-changing security landscape and emerging technologies,” says Lynn Miyashita, MSRC Bug Bounty Community-based Defense Security.
“The new Microsoft AI bounty program comes as a result of key investments and learnings over the last few months, including an AI security research challenge and an update to Microsoft’s vulnerability severity classification for AI systems.”
According to the Redmond giant, any vulnerabilities in the AI-powered Bing experiences on bing.com in Browser, including Bing Chat, Bing Chat for Enterprise, and Bing Image Creator, are within the scope of the new bounty program.
Further, AI-powered Bing integrations that are eligible for bounty awards are Microsoft Edge (Windows), including Bing Chat for Enterprise, Microsoft Start Application (iOS and Android), and the Skype Mobile Application (iOS and Android).
Microsoft says all security researchers across the globe, regardless of their prior experience or location, can participate in this bug bounty program. Researchers can submit their results through the Microsoft Security Research Center (MSRC) portal in the “Bing” section, and include the conversation ID, and describe the attack vector.
The company may accept or reject any submission at its sole discretion that it determines does not meet the above criteria.
To be eligible for bounty awards, Bing users must inform Microsoft of a previously unknown vulnerability, which is, per the company’s criteria, either “Critical” or “Important” severity to security. They must also include clear, concise, and reproducible steps, either in writing or in video format, on how to reproduce the issue on the latest, fully patched version of the product or service.
Microsoft is looking for vulnerabilities that fulfill the following definitions:
- Influencing and changing Bing’s chat behavior across user boundaries, i.e. change the AI in ways that impact all other users.
- Modifying Bing’s chat behavior by adjusting client and/or server visible configuration, such as setting debug flags, changing feature flags, etc.
- Breaking Bing’s cross-conversation memory protections and history deletion.
- Revealing Bing’s internal workings and prompts, decision making processes and confidential information.
- Bypassing Bing’s chat mode session limits and/or restrictions/rules.
The new program will offer bounty rewards from $2,000 to $15,000 for qualified submissions, with the highest rewards reserved for the severity and impact of the vulnerability in its AI-powered “Bing experience,” as well as on the submission’s quality. Eligible submissions will be awarded the single highest qualifying award.
“The Microsoft AI bounty program’s scope is limited to technical vulnerabilities in the AI-powered Bing experiences in the identified products and services. If you discover customer data while conducting your research, or are unclear if it is safe to proceed, please stop and contact us at [email protected],” Lynn notes.
You can check out the program’s page for more information on the new AI-powered Bing bug bounty program.
