Microsoft’s Bing AI Bug Bounty Program: Up to $15,000 in Rewards

RK Desk
AI, Bing Search, Microsoft

Microsoft has launched a new initiative to enhance the security of its AI-powered Bing services and apps. This initiative, known as the Microsoft AI Bounty Program, encourages security researchers worldwide to identify and report vulnerabilities in Bing. The program offers lucrative rewards ranging from $2,000 to $15,000, depending on the severity of the discovered issues.

Program Description

The Microsoft AI Bounty Program invites security researchers from across the globe to discover vulnerabilities in the new, innovative, AI-powered Bing experience. Qualified submissions are eligible for bounty rewards from $2,000 to $15,000 USD.

In-Scope Services and Products

Vulnerabilities submitted in the following products are eligible under this bounty program:

AI-powered Bing experiences on bing.com in Browser (All major vendors are supported, including Bing Chat, Bing Chat for Enterprise, and Bing Image Creator)
AI-powered Bing integration in Microsoft Edge (Windows), including Bing Chat for Enterprise
AI-powered Bing integration in the Microsoft Start Application (iOS and Android)
AI-powered Bing integration in the Skype Mobile Application (iOS and Android).

Eligible Submissions

The goal of the Microsoft AI bounty program is to uncover significant vulnerabilities in the new, innovative, AI-powered Bing experience that have a direct and demonstrable impact on the security of our customers. Vulnerability submissions must meet the following criteria to be eligible for bounty awards:

Identify a vulnerability in the AI-powered Bing that was not previously reported to, or otherwise known by, Microsoft. Such vulnerability must be Critical or Important severity as defined by the Microsoft Vulnerability Severity Classification for AI Systems and reproducible on the latest, fully patched version of the product or service.
Include clear, concise, and reproducible steps, either in writing or in video format. Provide our engineers with the information necessary to quickly reproduce, understand, and fix the issue.

Responsible Testing and Engagement

Researchers are encouraged to create a test account and test tenants for security testing and probing. They should follow the Research Rules of Engagement to avoid harm to customer data, privacy, and service availability. If in doubt, they can contact bounty@microsoft.com.

This program is a significant step by Microsoft toward enhancing its security measures. It not only helps secure their products but also provides an opportunity for researchers worldwide to contribute towards making the internet a safer place.