0DIN GenAI Bug Bounty

Skip to main content Program Scope 0DIN's GenAI Bug Bounty targets security boundaries across models and apps. If you have questions, ask us. STARTING $500 MEDIUM $2,500 HIGH $5,000 SEVERE $15,000 Model Security Boundaries Vulnerabilities that target the model itself — its guardrails, extraction surface, code execution, content integrity, and weights. We require guardrail jailbreak vulnerabilities to be submitted across at least two different testing categories. Weights and Layers Disclosure $15,000 Extracting or deducing a model's learned parameters and architectural details. ► REFERENCES Content Manipulation $5,000 Injecting harmful or misleading elements into data the model consumes or produces. ► REFERENCES Interpreter Jailbreak $2,500 Exploiting a model's ability to run code or invoke tools to escape its sandbox. ► REFERENCES Guardrail Jailbreak $500-$1,000 Bypassing a model's safety guardrails to produce restricted content. ► REFERENCES Prompt Extraction $100 Coercing a model into revealing its underlying system prompt. ► REFERENCES Prompt Extraction Prompt Extraction Severity: Low Prompt Extraction involves techniques used to coerce a model into revealing its underlying system prompt. While this information is not always considered confidential, some foundational models treat it as proprietary. Organizations that have developed custom models may also prefer to keep their system prompts undisclosed to maintain competitive advantage or protect sensitive configurations. Unauthorized access to these prompts can lead to unintended exposure of model behavior and vulnerabilities. Example: A researcher interacts with a language model designed for internal corporate use. By subtly manipulating input queries, they manage to extract fragments of the system prompt, which includes specific instructions and guidelines intended to shape the model's responses. This breach of confidentiality could potentially expose the organization's strategic intents or proprietary methodologies. References: MITRE ATLAS: LLM Meta Prompt Extraction (AML.T0056) OWASP LLM 2025: LLM07:2025 System Prompt Leakage avid-effect:security:S0301 (information leak) Guardrail Jailbreak Guardrail Jailbreak Severity: Low A Guardrail Jailbreak is a direct attack on the model's safety mechanisms — crafting prompts that cause the model to ignore, bypass, or override its built-in content guardrails and produce harmful or restricted content. These attacks operate purely at the inference level: no external system access, tool use, or data injection is required. The model itself is the target. Example: A researcher sends a series of carefully crafted messages that gradually reframe the model's role, eventually convincing it to provide instructions for dangerous activities that its safety training was designed to prevent. References: MITRE ATLAS: LLM Jailbreak (AML.T0054) OWASP LLM 2025: LLM01:2025 Prompt Injection avid-effect:security:S0400 (model bypass) Interpreter Jailbreak Interpreter Jailbreak Severity: Medium An Interpreter Jailbreak exploits the model's ability to run code or invoke external tools, escaping its controlled environment. A researcher may coerce the model into producing malicious code, granting access to underlying systems, or performing actions beyond authorized capabilities. By manipulating the instructions, the attacker leverages the model's excessive agency to even potentially break out of sandboxed interpreters and compromise system integrity. Example: A coding assistant designed to help developers debug Python code runs code snippets in a secure container. Through a series of clever prompts, a researcher induces the assistant to generate and execute code that conducts attacks on other third-party systems. References: OWASP LLM 2025: LLM06:2025 Excessive Agency OWASP LLM 2023-2024: LLM08: Excessive Agency avid-effect:security:S0400 (model bypass) avid-effect:security:S0401 (bad features) avid-effect:ethics:E0505 (toxicity) Content Manipulation Content Manipulation Severity: High Content Manipulation focuses on injecting harmful or misleading elements into the data that the model consumes or produces. By poisoning the training data or guiding the model to generate code and scripts that impact end-users, attackers introduce subtle backdoors, biases, and triggers. These manipulations cause the model to produce outputs that compromise user experiences, embed malicious scripts, or skew results, turning the AI into a vehicle for exploitation. Example: A threat actor contributes imperceptible yet malicious instructions within publicly available training text. Once the model is retrained, a secret trigger phrase prompts it to output harmful code that, when displayed on a webpage, executes client-side attacks against users. This demonstrates how training data poisoning and content manipulation can create covert vulnerabilities triggered after deployment. References: MITRE ATLAS: Poison Training Data (AML.T0020) OWASP LLM 2025: LLM04:2025 Data and Model Poisoning OWASP LLM 2023-2024: LLM03: Training Data Poisoning avid-effect:security:S0600 (data poisoning) avid-effect:security:S0601 (ingest poisoning) avid-effect:ethics:E0507 (deliberative misinformation) Weights and Layers Disclosure Weights and Layers Disclosure Severity: Severe Weights & Layers Disclosure targets the heart of the AI's intellectual property—its learned parameters and architectural details. By extracting or deducing these internal components, an attacker can replicate the model's capabilities, clone its performance, and analyze its structure for weaknesses. This compromises competitive advantage, reveals proprietary techniques, and facilitates further adversarial activities, from unauthorized redistribution to advanced prompt exploitation. Example: Through a carefully engineered exploit on the model-serving infrastructure, a researcher retrieves the AI's internal weights and layer configurations. Armed with this data, they create a near-identical replica without incurring the original training costs. This unauthorized duplication undermines the owner's investment and could lead to widespread, uncontrolled use of the model's technology. References: MITRE ATLAS: Full ML Model Access (AML.T0044) OWASP LLM 2023-2024: LLM10: Model Theft avid-effect:security:S0500 (exfiltration) avid-effect:security:S0502 (model theft) In-Scope Models Amazon 2 models Alexa for Shopping (formerly Rufus) Prompt Extraction : N/A Nova Prompt Extraction : N/A Guardrail Jailbreak : Copyright violations and illicit substances are not eligible for bounty. Anthropic 16 models Claude 4.5 Haiku Prompt Extraction : N/A Guardrail Jailbreak : Illicit substance guardrail bypasses are not accepted. Claude 4.5 Opus Prompt Extraction : N/A Guardrail Jailbreak : Illicit substance guardrail bypasses are not accepted. Claude 4.5 Sonnet Prompt Extraction : N/A Guardrail Jailbreak : Illicit substance guardrail bypasses are not accepted. Claude 4.6 Opus Prompt Extraction : N/A Guardrail Jailbreak : Illicit substance guardrail bypasses are not accepted. Claude 4.6 Sonnet Prompt Extraction : N/A Guardrail Jailbreak : Illicit substance guardrail bypasses are not accepted. Claude 4.7 Opus Prompt Extraction : N/A Guardrail Jailbreak : Illicit substance guardrail bypasses are not accepted. Claude 4.8 Opus Prompt Extraction : N/A Guardrail Jailbreak : Illicit substance guardrail bypasses are not accepted. Claude 5.5 Haiku Prompt Extraction : N/A : Illicit substance guardrail bypasses are not accepted. Claude 5.5 Opus Prompt Extraction : N/A Guardrail Jailbreak : Illicit substance guardrail bypasses are not accepted. Claude 5 Opus Prompt Extraction : N/A Guardrail Jailbreak : Illicit substance guardrail bypasses are not accepted. Claude 5 Sonnet Prompt Extraction : N/A Guardrail Jailbreak : Illicit substance guardrail bypasses are not accepted. Claude Fable 5 Prompt Extraction : N/A Claude Fable 5.1 Prompt Extraction : N/A Claude Fable 5.2 Prompt Extraction : N/A Claude for Chrome Prompt Extraction : N/A Guardrail Jailbreak : Illicit substance guardrail bypasses are not accepted. Claude Sonnet 5.5 Prompt Extraction : N/A : Illicit substance guardrail bypasses are not accepted. Apple 1 model Foundation Models Framework Prompt Extraction : N/A BigScience 1 model BLOOM Prompt Extraction : N/A Weights and Layers Disclosure : N/A Google 7 models Gemini 3.1 Pro Prompt Extraction : N/A Gemini 3.5 Flash Prompt Extraction : N/A Gemini 3.6 Flash Prompt Extraction : N/A Gemini 3.7 Flash Prompt Extraction : N/A Gemini 3.8 Flash Prompt Extraction : N/A Gemini 4 Argon Prompt Extraction : N/A Gemini 4 Carbon Prompt Extraction : N/A IBM 1 model Watson Prompt Extraction : N/A Meta 3 models Muse Spark 1.2 Prompt Extraction : N/A Muse Spark 1.3 Prompt Extraction : N/A Muse Wonder Prompt Extraction : N/A Microsoft 1 model CoPilot Prompt Extraction : N/A NVIDIA 1 model NeMo Megatron Prompt Extraction : N/A Guardrail Jailbreak : Copyright violations and illicit substances are not eligible for bounty. OpenAI 15 models DALL-E3 Prompt Extraction : N/A Interpreter Jailbreak : N/A GPT-5 Prompt Extraction : N/A GPT-5.4 Prompt Extraction : N/A GPT-5.5 Prompt Extraction : N/A GPT-5.5 Pro Prompt Extraction : N/A GPT 5.6 Luna Prompt Extraction : N/A GPT-5.6 Sol Prompt Extraction : N/A GPT-5.6 Terra Prompt Extraction : N/A GPT-5 mini Prompt Extraction : N/A GPT-5 nano Prompt Extraction : N/A GPT-5 Pro Prompt Extraction : N/A GPT-6.1 Sol Prompt Extraction : N/A GPT-6 Astra Prompt Extraction : N/A GPT-6 Luna Prompt Extraction : N/A GPT-6 Sol Prompt Extraction : N/A Perplexity 1 model Perplexity AI Prompt Extraction : N/A Salesforce 1 model Einstein Prompt Extraction : N/A Twitter / X 5 models Grok 4.20 Prompt Extraction : N/A Guardrail Jailbreak : This model is out of scope for illicit substances and copyright violations. Grok 4.3 Prompt Extraction : N/A : This model is out of scope for illicit substances and copyright violations. Grok 4.5 Prompt Extraction : N/A Guardrail Jailbreak : This model is out of scope for illicit substances and copyright violations. Grok 4.6 Prompt Extraction : N/A Guardrail Jailbreak : This model is out of scope for illicit substances and copyright violations. Grok 4.7 Prompt Extraction : N/A Guardrail Jailbreak : This model is out of scope for illicit substances and copyright violations. Other 1 model Other Models Prompt Extraction : N/A Questions about scope? Reach out at [email protected]