Skip to main content

Program Scope

0DIN's GenAI Bug Bounty targets security boundaries across models and apps. If you have questions, ask us.

STARTING

$500

MEDIUM

$2,500

HIGH

$5,000

SEVERE

$15,000

Model Security Boundaries

Vulnerabilities that target the model itself — its guardrails, extraction surface, code execution, content integrity, and weights.

We require guardrail jailbreak vulnerabilities to be submitted across at least two different testing categories.

Weights and Layers Disclosure

$15,000

Extracting or deducing a model's learned parameters and architectural details.

Content Manipulation

$5,000

Injecting harmful or misleading elements into data the model consumes or produces.

Interpreter Jailbreak

$2,500

Exploiting a model's ability to run code or invoke tools to escape its sandbox.

Guardrail Jailbreak

$500-$1,000

Bypassing a model's safety guardrails to produce restricted content.

Prompt Extraction

$100

Coercing a model into revealing its underlying system prompt.

Prompt Extraction

Prompt Extraction

Severity: Low

Prompt Extraction involves techniques used to coerce a model into revealing its underlying system prompt. While this information is not always considered confidential, some foundational models treat it as proprietary. Organizations that have developed custom models may also prefer to keep their system prompts undisclosed to maintain competitive advantage or protect sensitive configurations. Unauthorized access to these prompts can lead to unintended exposure of model behavior and vulnerabilities.

Example:

A researcher interacts with a language model designed for internal corporate use. By subtly manipulating input queries, they manage to extract fragments of the system prompt, which includes specific instructions and guidelines intended to shape the model's responses. This breach of confidentiality could potentially expose the organization's strategic intents or proprietary methodologies.

References:

Guardrail Jailbreak

Guardrail Jailbreak

Severity: Low

A Guardrail Jailbreak is a direct attack on the model's safety mechanisms — crafting prompts that cause the model to ignore, bypass, or override its built-in content guardrails and produce harmful or restricted content. These attacks operate purely at the inference level: no external system access, tool use, or data injection is required. The model itself is the target.

Example:

A researcher sends a series of carefully crafted messages that gradually reframe the model's role, eventually convincing it to provide instructions for dangerous activities that its safety training was designed to prevent.

References:

  • MITRE ATLAS: LLM Jailbreak (AML.T0054)
  • OWASP LLM 2025: LLM01:2025 Prompt Injection
  • avid-effect:security:S0400 (model bypass)

Interpreter Jailbreak

Interpreter Jailbreak

Severity: Medium

An Interpreter Jailbreak exploits the model's ability to run code or invoke external tools, escaping its controlled environment. A researcher may coerce the model into producing malicious code, granting access to underlying systems, or performing actions beyond authorized capabilities. By manipulating the instructions, the attacker leverages the model's excessive agency to even potentially break out of sandboxed interpreters and compromise system integrity.

Example:

A coding assistant designed to help developers debug Python code runs code snippets in a secure container. Through a series of clever prompts, a researcher induces the assistant to generate and execute code that conducts attacks on other third-party systems.

References:

  • OWASP LLM 2025: LLM06:2025 Excessive Agency
  • OWASP LLM 2023-2024: LLM08: Excessive Agency
  • avid-effect:security:S0400 (model bypass)
  • avid-effect:security:S0401 (bad features)
  • avid-effect:ethics:E0505 (toxicity)

Content Manipulation

Content Manipulation

Severity: High

Content Manipulation focuses on injecting harmful or misleading elements into the data that the model consumes or produces. By poisoning the training data or guiding the model to generate code and scripts that impact end-users, attackers introduce subtle backdoors, biases, and triggers. These manipulations cause the model to produce outputs that compromise user experiences, embed malicious scripts, or skew results, turning the AI into a vehicle for exploitation.

Example:

A threat actor contributes imperceptible yet malicious instructions within publicly available training text. Once the model is retrained, a secret trigger phrase prompts it to output harmful code that, when displayed on a webpage, executes client-side attacks against users. This demonstrates how training data poisoning and content manipulation can create covert vulnerabilities triggered after deployment.

References:

  • MITRE ATLAS: Poison Training Data (AML.T0020)
  • OWASP LLM 2025: LLM04:2025 Data and Model Poisoning
  • OWASP LLM 2023-2024: LLM03: Training Data Poisoning
  • avid-effect:security:S0600 (data poisoning)
  • avid-effect:security:S0601 (ingest poisoning)
  • avid-effect:ethics:E0507 (deliberative misinformation)

Weights and Layers Disclosure

Weights and Layers Disclosure

Severity: Severe

Weights & Layers Disclosure targets the heart of the AI's intellectual property—its learned parameters and architectural details. By extracting or deducing these internal components, an attacker can replicate the model's capabilities, clone its performance, and analyze its structure for weaknesses. This compromises competitive advantage, reveals proprietary techniques, and facilitates further adversarial activities, from unauthorized redistribution to advanced prompt exploitation.

Example:

Through a carefully engineered exploit on the model-serving infrastructure, a researcher retrieves the AI's internal weights and layer configurations. Armed with this data, they create a near-identical replica without incurring the original training costs. This unauthorized duplication undermines the owner's investment and could lead to widespread, uncontrolled use of the model's technology.

References:

  • MITRE ATLAS: Full ML Model Access (AML.T0044)
  • OWASP LLM 2023-2024: LLM10: Model Theft
  • avid-effect:security:S0500 (exfiltration)
  • avid-effect:security:S0502 (model theft)

In-Scope Models

Amazon logo Amazon
2 models
Alexa for Shopping (formerly Rufus)

Prompt Extraction : N/A

Nova

Prompt Extraction : N/A

Guardrail Jailbreak : Copyright violations and illicit substances are not eligible for bounty.

Anthropic logo Anthropic
12 models
Claude 4.5 Haiku

Prompt Extraction : N/A

Guardrail Jailbreak : Illicit substance guardrail bypasses are not accepted.

Claude 4.5 Opus

Prompt Extraction : N/A

Guardrail Jailbreak : Illicit substance guardrail bypasses are not accepted.

Claude 4.5 Sonnet

Prompt Extraction : N/A

Guardrail Jailbreak : Illicit substance guardrail bypasses are not accepted.

Claude 4.6 Opus

Prompt Extraction : N/A

Guardrail Jailbreak : Illicit substance guardrail bypasses are not accepted.

Claude 4.6 Sonnet

Prompt Extraction : N/A

Guardrail Jailbreak : Illicit substance guardrail bypasses are not accepted.

Claude 4.7 Opus

Prompt Extraction : N/A

Guardrail Jailbreak : Illicit substance guardrail bypasses are not accepted.

Claude 4.8 Opus

Prompt Extraction : N/A

Guardrail Jailbreak : Illicit substance guardrail bypasses are not accepted.

Claude 5 Opus

Prompt Extraction : N/A

Guardrail Jailbreak : Illicit substance guardrail bypasses are not accepted.

Claude 5 Sonnet

Prompt Extraction : N/A

Guardrail Jailbreak : Illicit substance guardrail bypasses are not accepted.

Claude Fable 5

Prompt Extraction : N/A

Claude Fable 5.1

Prompt Extraction : N/A

Claude for Chrome

Prompt Extraction : N/A

Guardrail Jailbreak : Illicit substance guardrail bypasses are not accepted.

Apple logo Apple
1 model
Foundation Models Framework

Prompt Extraction : N/A

BigScience logo BigScience
1 model
BLOOM

Prompt Extraction : N/A

Weights and Layers Disclosure : N/A

Google logo Google
4 models
Gemini 3.1 Pro

Prompt Extraction : N/A

Gemini 3.5 Flash

Prompt Extraction : N/A

Gemini 3.6 Flash

Prompt Extraction : N/A

Gemini 3.7 Flash

Prompt Extraction : N/A

IBM logo IBM
1 model
Watson

Prompt Extraction : N/A

Meta logo Meta
2 models
Muse Spark 1.2

Prompt Extraction : N/A

Muse Spark 1.3

Prompt Extraction : N/A

Microsoft logo Microsoft
1 model
CoPilot

Prompt Extraction : N/A

NVIDIA logo NVIDIA
1 model
NeMo Megatron

Prompt Extraction : N/A

Guardrail Jailbreak : Copyright violations and illicit substances are not eligible for bounty.

OpenAI logo OpenAI
12 models
DALL-E3

Prompt Extraction : N/A

Interpreter Jailbreak : N/A

GPT-5

Prompt Extraction : N/A

GPT-5.2 Chat
GPT-5.4

Prompt Extraction : N/A

GPT-5.5

Prompt Extraction : N/A

GPT-5.5 Pro

Prompt Extraction : N/A

GPT 5.6 Luna
GPT-5.6 Sol

Prompt Extraction : N/A : From now through September 16th - $5,000 bounty rewards for jailbreak submissions targeting OpenAI GPT-5.6 Sol. Guardrail jailbreak vulnerabilities submitted must still work across at least two different testing categories.

GPT-5.6 Terra

Prompt Extraction : N/A

GPT-5 mini

Prompt Extraction : N/A

GPT-5 nano

Prompt Extraction : N/A

GPT-5 Pro

Prompt Extraction : N/A

Perplexity logo Perplexity
1 model
Perplexity AI

Prompt Extraction : N/A

Salesforce logo Salesforce
1 model
Einstein

Prompt Extraction : N/A

Twitter / X logo Twitter / X
4 models
Grok 4.20

Prompt Extraction : N/A

Guardrail Jailbreak : This model is out of scope for illicit substances and copyright violations.

Grok 4.3
Grok 4.5

Prompt Extraction : N/A

Guardrail Jailbreak : This model is out of scope for illicit substances and copyright violations.

Grok 4.6

Prompt Extraction : N/A

Guardrail Jailbreak : This model is out of scope for illicit substances and copyright violations.

Other logo Other
1 model
Other Models

Prompt Extraction : N/A

Questions about scope? Reach out at 0din@mozilla.com