Asked about Running a safety evaluation
How would you handle disclosing a vulnerability you found?
An answer that works
Notify the developer, allow time to mitigate, then publish the class of problem rather than a working exploit. The tension between helping defenders and helping attackers is real and the norms are genuinely contested.
Reading an answer is not being able to give one. The section that teaches this is Running a safety evaluation, 4 hours of Safety & evaluation research.
Learn this properlyAlso asked about Safety & evaluation research
How do you evaluate whether a model has a dangerous capability?Why is a negative safety result weak evidence?What is red teaming?How do you make a safety evaluation's negative result meaningful?Why evaluate the system rather than the model?Your evaluation finds a model cannot complete a concerning task. What can you conclude?How would you red team an LLM application before launch?How would you test whether a model's chain of thought is faithful?