0DIN Expands: From Inference to Agency

What it is

0DIN (Mozilla's AI bug bounty program) has opened a new submission class for agentic AI vulnerabilities — prompt injections that cause data exfiltration, arbitrary writes, or code/command execution — alongside a tightened bar for inference-layer jailbreaks. The value here for a would-be submitter is the eligibility rules, which the summary does not spell out.

How it works (scoring model)

Agentic submissions are not scored with JEF (which is retained only for inference jailbreaks). They are graded on four axes:

• Violation class — the security boundary crossed.
• Impact severity — three tiers, and all qualifying submissions must involve private data. A single leaked file scores far below a full-database exfiltration.
• Attack vector — zero-click (no human interaction) ranks highest; social-engineering delivery ranks lower.
• Scope — single product < product class (e.g. "all MCP-enabled coding agents") < cross-platform (multiple vendors/categories).

Top payouts go to the intersection: high-impact + zero-click + cross-platform. Their worked example is a prompt injection in a GitHub issue that any MCP-connected coding agent exfiltrates repo secrets from with no user action beyond reviewing the issue.

Eligibility constraints (the actionable part)

• Attacks requiring explicit instruction are ineligible — e.g. anything of the form "paste this prompt into your agent" earns no bounty.
• Agentic scope maps to specific OWASP Top 10 for Agentic Applications categories (published Dec 2025): ASI01 Goal Hijacking, ASI02 Tool Misuse, ASI03 Identity & Privilege Abuse, ASI05 Unexpected Code Execution, ASI06 Memory & Context Poisoning. If your finding doesn't fit one of these, expect it out of scope.
• Inference jailbreaks now require retargetability across at least two JEF-tested boundaries — a single-boundary jailbreak no longer qualifies.

Preconditions / Affected

In scope: 29 products across coding agents, agentic browsers, enterprise agents, and general-purpose agents (OpenAI, Anthropic, Google, Microsoft, Salesforce, Amazon, and others). The blog does not list the 29 — the authoritative list is at 0din.ai/scope, which you must check before investing effort.

Caveats

• The post cuts off mid-section on the inference-jailbreak changes; full retargetability criteria aren't in the excerpt.
• The incident cited to justify severity (LangGrinch, CVE-2025-68664, CVSS 9.3, 847M LangChain downloads) is context, not itself in-scope for this program.
• Concrete bounty figures are not given — only relative calibration.