Microsoft expands Copilot bug bounty targets, payouts

Microsoft is so concerned about security in its Copilot products for folks that it’s lifted bug bounty payments for moderate-severity vulnerabilities from nothing to a maximum of $5,000, and expanded the range of vulnerabilities it will pay people to find and report. The payouts for less severe vulns were introduced because the software giant thinks "even moderate vulnerabilities can have significant implications for the security and reliability of our Copilot consumer products," explained Microsoft bounty team members Lynn Miyashita and Madeline Eckert earlier this month. Under the Copilot Bounty Program, researchers who identify and disclose previously unknown vulnerabilities can earn between $250 and $30,000. As is typical in bug bounty programs, higher payouts are reserved for those who report the most serious vulnerabilities, such as code injection or model manipulation. Microsoft classifies security flaws into four severity levels - Critical, Important, Moderate, and Low - based on the Microsoft Vulnerability Severity Classification for AI Systems and the Microsoft Vulnerability Severity Classification for Online Services. Redmond also recently expanded the Copilot (AI) Bounty Program to cover 14 types of vulnerability, up from three, an understandable decision given its push to embed the generative AI assistants across its product portfolio. The three old-school vulns are inference manipulation, model manipulation and inferential information disclosure. The new vuln ty...