Better Bug Bounties? Lessons on Disclosure of Security Vulns v. AI Harms

on YouTube ↗38m

" summary

Presents findings from Algorithmic Justice League research comparing the security vulnerability disclosure ecosystem (bug bounty-style reporting) with reporting mechanisms for harms from AI systems. Discusses concrete lessons on designing participatory reporting channels and how existing programs and platforms could evolve to handle socio-technical challenges posed by AI.

AI-written summary · about

" chapters (9)

1. 0:00Start
2. 1:55What is the CRASH Project?
3. 7:27Program Design Levers
4. 21:41Vulnerability Disclosure Programs
5. 23:02Self-Managed Bug Bounties
6. 24:34Platform Bug Bounties - Public
7. 26:42Industry Bounties
8. 27:32Open-Source / Non-Profit Bug Bounties
9. 32:09IAB Design Overview

" related talks

• 29mIdentifying and Assigning AI Model VulnerabilitiesD’Nae Ferguson, Kyle Kilian · CVE/FIRST VulnCon 2025
• 48mThe Law and Economics of Bug BountiesAmit Elazari Bar On · USENIX Security '18
• 30mDoes Public Disclosure of Vulnerabilities Affect Hacker Participation in Bug Bounty Programs?Ali Ahmed, Amit Deokar, Brian Lee · Black Hat USA 2023
• 51mBug Bounty: Keeping Hacks Ethical in 2022Daniel Garrie, David Cass · RSA Conference 2023
• 50mTo bounty, or not to bounty? Security@ insights from 500 organizationsAlex Rice · OWASP AppSec California 2016
• 42mInfosec, AI and ethics – new models for a secure futureKate Carruthers · Code Mesh LDN 2018
• 15m"You've Got Your Nice List of Bugs, Now What?" Vulnerability Discovery and ManagementSerge Egelman, Primal Wijesekera, Noura Alomar, Edward Qiu · SOUPS 2020
• 25mEverything Old Is New Again: Legal Restrictions on...Kendra Albert · USENIX Security '25