Microsoft

Type: AI company
Lieu: États-Unis — USA
Dernière vérification: 2026-09-22
Prochaine vérification: 2027-03-21

Pas encore traduit — affiché en anglais.

Comment les joindre

MSRC Researcher Portal · Responsible disclosure programme
https://msrc.microsoft.com/report/
Vérification expirée
Preuve que ce moyen accepte les prises de contact
Security vulnerability submissions including AI systems, graded against the AI bug bar.
Also reachable as aka.ms/secure-at per the Copilot bounty page.
Microsoft Copilot AI Bounty · Bug or safety bounty
https://www.microsoft.com/en-us/msrc/bounty-ai
Contact à accès limité · 2026-09-22
Qui peut l’utiliser: users-meeting-published-eligibility
Restrictions: $250-$30,000. Security vulnerabilities in Copilot surfaces. Explicitly EXCLUDES 'AI prompt injection attacks that do not have a security impact on users other than the attacker', 'model hallucination where the model pretends to run arbitrary code', and 'attacks that aim to leak (part of) the system/meta prompt'. Content issues must be reported separately as 'AI derived harm'.
Preuve que ce moyen accepte les prises de contact · 2026-09-22
$250-$30,000. Security vulnerabilities in Copilot surfaces. Explicitly EXCLUDES 'AI prompt injection attacks that do not have a security impact on users other than the attacker', 'model hallucination where the model pretends to run arbitrary code', and 'attacks that aim to leak (part of) the system/meta prompt'. Content issues must be reported separately as 'AI derived harm'.
One of the clearest published statements anywhere that jailbreak-style findings are not a bounty item.
AI/ML Vulnerability Severity Classification (AI bug bar) · Responsible disclosure programme
https://www.microsoft.com/en-us/msrc/aibugbar
Contact à accès limité · 2026-09-22
Qui peut l’utiliser: users-meeting-published-eligibility
Restrictions: Splits AI issues into security vulnerabilities (CVSS-rated: inference manipulation, membership inference, model theft) and Responsible AI issues (hate speech, misinformation, sexual content, self-harm) classified only 'In Scope' or 'Out of Scope for investigation, without severity ratings'.
Preuve que ce moyen accepte les prises de contact · 2026-09-22
Splits AI issues into security vulnerabilities (CVSS-rated: inference manipulation, membership inference, model theft) and Responsible AI issues (hate speech, misinformation, sexual content, self-harm) classified only 'In Scope' or 'Out of Scope for investigation, without severity ratings'.
Notably says Microsoft 'actively welcome[s] submissions related to safety and societal harm' — a rare explicit invitation. CSEAM must go to Report a Concern instead.
Report a Concern (Digital Safety) · Web form
https://www.microsoft.com/digitalsafety/report-a-concern
Vérification expirée
Preuve que ce moyen accepte les prises de contact
Harmful content across Microsoft services, including AI-generated.
The consumer-facing route MSRC redirects content reports to.
Enterprise AI Services abuse report · Web form
https://go.microsoft.com/fwlink/?linkid=2299798
Contact à accès limité · 2026-09-22
Qui peut l’utiliser: users-meeting-published-eligibility
Restrictions: Reporting abusive, illegal or infringing use of a Microsoft AI Service.
Preuve que ce moyen accepte les prises de contact · 2026-09-22
Reporting abusive, illegal or infringing use of a Microsoft AI Service.
Published in the Code of Conduct for Microsoft AI Services.
Homepage · Homepage
https://www.microsoft.com/ai/responsible-ai
Vérification expirée
Preuve que ce moyen accepte les prises de contact
Frontier Governance Framework (February 2026; first version February 2025) · Published policy or framework
https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Frontier-Governance-Framework-Feb-2026.pdf
Vérification expirée
Preuve que ce moyen accepte les prises de contact

Ce qu'il fait

Office of Responsible AI and a Chief Responsible AI Officer maintain the Responsible AI Standard and review revisions to the Frontier Governance Framework; MSRC handles security and an AI-specific severity bug bar.

Évaluation franche

No large body of public complaints specific to Microsoft's AI safety intake, and the AI bug bar is unusually candid about what it will and will not investigate. The honest read: security-impacting AI bugs get a real, paid, well-run process through MSRC; pure model-behaviour findings get a 'Responsible AI' classification with no severity and no stated timeline, which is closer to a content-moderation queue than a safety review. Microsoft has publicly said it will pay out for high-impact bugs even outside formal bounty scope (The Register, Dec 2025).

Notes

Use the AI bug bar page first to decide which door you are at — it is the single most useful triage document published by any company here. Safe harbour exists as 'Legal Safe Harbor' in the bounty terms at https://www.microsoft.com/en-us/msrc/bounty-guidelines#safeharbor. The Frontier Governance Framework's whistleblower route is internal only, with anonymous reporting and anti-retaliation for employees; there is no external equivalent.

Sources

https://www.microsoft.com/en-us/msrc/bounty-ai · 2026-09-22
https://www.microsoft.com/en-us/msrc/aibugbar · 2026-09-22
https://go.microsoft.com/fwlink/?linkid=2299798 · 2026-09-22

Une erreur ?