Teen Researcher: AI Bug Denied, Later Fixed Without Credit

Posted4 months agoActive4 months ago

Anh_khoa

6 points

2 comments

Techstory

skepticalmixed

Debate

40/100

Artificial IntelligenceBug BountyVulnerability Disclosure

Key topics

Artificial Intelligence

Bug Bounty

Vulnerability Disclosure

I’m 14, based in Vietnam, and in July I discovered a vulnerability that exposed the system prompt of a major AI model. I responsibly reported it via the official bug bounty program. Response: “Out of scope, just an AI issue.”

Weeks later, I checked again — the bug had been quietly patched. No acknowledgment, no credit.

If it’s “not a bug,” why fix it? And if it’s fixed, why dismiss the report?

Sharing here to hear thoughts from the security community.

A 14-year-old researcher discovered an AI vulnerability, reported it, but received no credit after it was fixed.

Snapshot generated from the HN discussion

Discussion Activity

Light discussion

First comment

30m

Peak period

0-1h

Avg / period

Key moments

01Story posted
Sep 10, 2025 at 2:43 AM EDT
4 months ago
Step 01
02First comment
Sep 10, 2025 at 3:13 AM EDT
30m after posting
Step 02
03Peak activity
1 comments in 0-1h
Hottest window of the conversation
Step 03
04Latest activity
Sep 10, 2025 at 5:00 AM EDT
4 months ago
Step 04

Generating AI Summary...

Analyzing up to 500 comments to identify key contributors and discussion patterns

Discussion (2 comments)

Showing 2 comments

thankIsrael

4 months ago

If it is fixed, you can tell us what the bug is here. If your bug is just typing a prompt, than what you probably experienced is hallucination, and the hallucination has now been rectified.

yorwba

4 months ago

"Out of scope" doesn't mean it's not a bug, it means that it's not the kind of bug they pay bounties for. You'll need to read the fine print of the bug bounty program to find out which bugs are eligible and which are out of scope.

View full discussion on Hacker News

ID: 45194116Type: storyLast synced: 11/17/2025, 6:10:15 PM

Want the full context?

Jump to the original sources

Read the primary article or dive into the live Hacker News thread when you're ready.

View on HN