OpenAI announced the launch of a public Safety Bug Bounty program designed to identify AI abuse and safety risks across its product line. The initiative is intended to complement the existing Security Bug Bounty by accepting issues that pose meaningful abuse and safety risks even if they do not meet the criteria for a security vulnerability. The program focuses on AI‑specific safety scenarios, including third‑party prompt injection and data exfiltration that can reliably hijack a victim’s agent, disallowed actions performed by agentic OpenAI products at scale, and other potentially harmful actions. Submissions are triaged by OpenAI’s Safety and Security Bug Bounty teams and may be rerouted between the two programs depending on scope and ownership. While jailbreaks are out of scope, OpenAI periodically runs private bug bounty campaigns for specific harm types such as Biorisk content issues. Researchers are invited to apply through the Safety Bug Bounty portal, and the company emphasizes its commitment to working with the safety and security community to maintain a secure AI ecosystem.
Introducing the OpenAI Safety Bug Bounty program
OpenAI has launched a new Safety Bug Bounty program to identify AI abuse and safety risks across its products, complementing its existing Security Bug Bounty. The program targets issues such as prompt injection, data exfiltration, disallowed agent actions, and other safety‑specific vulnerabilities that may not qualify as traditional security bugs. Researchers can submit findings through the Safety Bug Bounty portal, and submissions will be triaged by OpenAI’s Safety and Security Bug Bounty teams.
Why it matters
By expanding its bug‑bounty scope to safety‑specific vulnerabilities, OpenAI aims to proactively address misuse that could cause tangible harm, reinforcing trust in AI systems.
Topic dossiers OpenAI