Google bug hunters have earned over $430,000 in AI-product related rewards since the original AI Vulnerability Reward Program was launched in October 2023. Now Google has updated the rules to help security researchers focus on the highest-impact (and highest-reward-value) targets.

As well as listing the types of attacks are considered "in-scope" for rewards in the AI-focused program Google has also clarified those that aren't. Specifically, direct prompt injection, jailbreaks, and alignment issues don't count, although researchers are encouraged to report such content-related issues "in-product".  

So what security flaws should bug hunters look for. This list has the most important at the top:

Google has also specified three product tiers from Flagship, through Standard to Other:

And finally here is the Reward Matrix:

As is the case for the general Google Vulnerability Reward Program, these rewards are subject to report multipliers which can both increase and decrease the payout. 

The multipliers are currently:

• Low Quality: 0.8x (to be reduced to 0.5x in the future)
• Good Quality: 1.0x
• Exceptional Quality: 1.2x

There is also a new "Novelty Bonus" to explicitly recognize truly unique or innovative research. This discretionary bonus, ranging from +$1,000 to +$5,000, will be awarded for reports that cause Google's security teams to think differently about a problem or uncover entirely new vulnerability classes.

More Information

Google’s New AI Vulnerability Reward Program

AI Vulnerability Reward Program Rules

Related Articles

Over $21 Million In Google Bug Bounty

Google Offers Bug Bounty Up to $1.5 Million

Google Extends Bug Bounty To Third Party Apps

Google Increases Android Bug Rewards

Hack A Chromebook for $100,000 

New Android Bug Bounty Scheme

Google Increases Maximum Bounty For Chrome Bugs

To be informed about new articles on I Programmer, sign up for our weekly newsletter, subscribe to the RSS feed and follow us on Twitter, Facebook or Linkedin.

Comments

Make a Comment or View Existing Comments Using Disqus

or email your comment to: comments@i-programmer.info