OpenAI

Description

OpenAI Security Bug Bounty Policy IMPORTANT: MODEL SAFETY ISSUES ARE OUT OF SCOPE Findings limited to model behavior, including jailbreaks, hallucinations, and prompt-based safety bypasses, are out of scope for OpenAI's Security Bug Bounty. See section 3 before submitting a model-related report. A model-assisted attack can qualify here if it exploits a separate flaw in an in-scope OpenAI product or OpenAI-controlled integration. tl;dr of what's included in the new bug bounty program 💰 Higher payouts: More than 4x higher reward midpoints on average for medium, high, and critical vulnerabilities. 🎯 Quality bonuses: Earn additional rewards for high-quality reports with strong proof of concepts. 🏆 Loyalty program: A new 5-tier program rewarding researchers for consistently finding valid vulnerabilities. 🔥 Priority campaigns: Additional bonus multipliers for vulnerabilities found during special campaigns. 💎 Stackable bonuses: Exceptional findings can now earn up to $172,000 with bonuses! For details on bonuses, see Researcher Rewards and Multipliers . Welcome Security is essential to OpenAI's mission. We appreciate the contributions of ethical hackers who help us uphold high privacy and security standards for our users and technology. This policy, based on disclose.io , outlines our definition of good faith regarding the discovery and reporting of vulnerabilities and clarifies what researchers can expect from OpenAI in return. Vulnerability Ratings and Rewards The initial priority rating for most findings will use the Bugcrowd Vulnerability Rating Taxonomy (VRT) . However, vulnerability priority and rewards may be modified based on likelihood or impact at OpenAI's sole discretion. In cases of downgraded issues, researchers will receive a detailed explanation. Use the applicable scope group to find the base reward for a qualifying vulnerability. For the core product groups, the exceptional Critical amount is a base award. See Researcher Rewards and Multipliers for applicable bonuses. You may still report Low (P4) and Informational (P5) findings, but those priorities do not carry a base bounty. Note that the OpenAI API Keys group has separate rules for its monthly award.

1. Our Commitments to Researchers As part of this policy, OpenAI commits to: Safe Harbor: Provide Safe Harbor protection, as outlined below, for vulnerability research conducted according to these guidelines. Communication: Cooperate with researchers in understanding and validating their reports, ensuring a prompt initial response. Remediation: Remediate validated vulnerabilities in a timely manner. Recognition: Acknowledge and credit researchers who are first to report a unique vulnerability that leads to a code or configuration change.
2. Rules of Engagement Researchers are authorized to perform security testing in compliance with this policy. To help distinguish good-faith security research from malicious activity, researchers must follow these rules. 2.1 Authorized Testing You are authorized to perform testing in compliance with this policy. Follow this policy and any other relevant agreements. In case of inconsistency, this policy takes precedence. Test only in-scope systems and respect out-of-scope systems. Interact only with your own accounts unless authorized by OpenAI. Refrain from violating privacy, disrupting systems, destroying data, or harming user experience. 2.2 Data Protection Do not access, modify, or use data belonging to others, including confidential OpenAI data. If a vulnerability exposes such data, stop testing immediately. Report where and how you found it without including its contents. Do not retrieve additional records to demonstrate impact. Delete any copies you obtained and use accounts and data you control to demonstrate the issue. 2.3 Reporting and Disclosure Promptly report discovered vulnerabilities. Use this Security Bug Bounty for vulnerability reports and related communication. Submit publicly exposed customer API keys only through the OpenAI API Key Bug Bounty Submission Form . If an in-scope OpenAI product flaw exposes keys, report the flaw here and redact all key values, including in attachments. Keep vulnerability details confidential until authorized for release by OpenAI's security team, which aims to provide authorization within 90 days of report receipt. Disclosure of vulnerabilities to OpenAI must be unconditional. Do not engage in extortion, threats, or other tactics to elicit a response under duress. OpenAI denies Safe Harbor for vulnerability disclosure conducted under such circumstances.
3. Model Issues and Out-of-Scope Vulnerabilities IMPORTANT: READ BEFORE SUBMITTING MODEL-RELATED REPORTS OpenAI is committed to making AI safe and useful for everyone . Before releasing a new system, we thoroughly test it, get expert feedback, improve its behavior, and set up safety measures. While we work hard to prevent risks, we cannot predict every way people will use or misuse our technology in the real world. For a model-assisted attack such as prompt injection, identify the control the in-scope OpenAI product or OpenAI-controlled integration should have enforced. Use test data to show the unauthorized access, disclosure, or action. For example, show how an attacker caused private data to be sent to a recipient the application should have blocked. If an agent misuses permissions it already has and no separate product control failed, see Reporting Model-Related Issues . 3.1 Model Safety Issues The following are out of scope: Jailbreaks and safety bypasses (e.g., DAN and related prompts). Getting the model to say bad things to you. Getting the model to tell you how to do bad things. Getting the model to write malicious code for you. 3.2 Model Hallucinations Model hallucinations are also out of scope, including: Getting the model to pretend to do bad things. Getting the model to pretend to give you answers to secrets. Getting the model to pretend to be a computer and execute code.
4. Reporting Model-Related Issues Report a demonstrated bypass of an in-scope OpenAI product control, including an eligible sandbox escape, through this Security Bug Bounty. If attacker-controlled content causes an agent to disclose sensitive data or take a harmful action using permissions it already has, check the Safety Bug Bounty for eligibility. For general feedback on a model response, use the thumbs-down control in ChatGPT or, if your organization has enabled feedback, in the API Playground. For model-related issues, please use: OpenAI Model Behavior Feedback OpenAI will provide Safe Harbor protection, as outlined below, for model issues research conducted in accordance with this policy. Academic Research In some very limited cases, OpenAI may reward academic research related to: Model safety. Disclosure of model weights. Training data. Related concerns. Please submit research papers to [email protected] for consideration.
5. Researcher Rewards and Multipliers OpenAI recognizes researchers who submit high-quality vulnerability reports and consistently contribute to improving our security. Our rewards structure includes: Report-quality multipliers: Additional rewards for particularly useful, high-quality submissions. Priority campaign multipliers: Increased rewards for research on selected targets or campaigns. Researcher loyalty bonuses: Additional payouts for researchers with a sustained history of valid, impactful submissions. These adjustments are separate from the underlying vulnerability priority and impact, which determine the initial award. 5.1 Report Quality and Campaign Multipliers Multipliers may adjust a vulnerability's base reward based on report quality or participation in a designated research campaign. Category │ Multiplier │ Description Low-quality report │ Up to 0.85× │ Difficult to understand; requires significant follow-up to identify and remediate the issue Standard-quality report │ 1.00× │ Sufficient information to reproduce and evaluate the vulnerability High-quality report │ Up to 1.15× │ Clear proof of concept, precise prerequisites, useful evidence, and accurate impact analysis Priority campaign │ Up to 1.30× │ Time-limited research targeting difficult or strategically important systems How Multipliers Work Only one quality multiplier and one campaign multiplier may apply to a submission. Quality and campaign multipliers can be combined. An incomplete report remains in Needs More Information until it meets the minimum submission standard. Core award = Base reward × Quality multiplier × Campaign multiplier We calculate the loyalty bonus as a percentage of the core award and add it to that award. For example, a 15% loyalty bonus brings the total to 1.15 times the core award. 5.2 Researcher Loyalty Program Our five-tier loyalty program recognizes researchers who consistently identify valid, impactful security vulnerabilities. As researchers make meaningful contributions, they can qualify for higher loyalty tiers and additional rewards on future valid submissions. Loyalty bonuses are separate from report-quality and campaign multipliers. Loyalty Tiers Loyalty tier │ Additional reward │ Qualification Standard │ 0% │ New researchers or insufficient program history Bronze │ +5% │ At least 3 impact points over the trailing 12 months Silver │ +7.5% │ At least 10 impact points Gold │ +10% │ At least 20 impact points 31337 │ +15% │ At least 30 impact points Researchers become eligible for the loyalty program after two lifetime valid submissions . How Impact Points Work Researchers earn impact points based on the priority of their valid vulnerability reports. Finding classification │ Impact points P1 │ 10 P2 │ 4 P3 │ 1 P4 or P5 │ 0 Duplicate or invalid │ 0 False positive │ −1 Loyalty tiers are calculated using impact points accumulated over the trailing 12 months . 5.3 How Rewards Stack Researchers can earn multiple bonuses on the same valid vulnerability report. The final reward is calculated by applying each eligible multiplier to the base reward: Final reward = Base reward × Quality multiplier × Campaign multiplier × Loyalty multiplier For example: A high-quality report can receive up to a 1.15× multiplier. If the finding is part of a priority campaign, an additional multiplier of up to 1.30× can apply. If the researcher belongs to our 31337 loyalty tier, an additional 1.15× multiplier applies. These multipliers stack multiplicatively. Example 1: Critical Vulnerability with Stacking Bonuses A researcher discovers a critical vulnerability in ChatGPT involving a one-click account takeover. Submits a high quality report and is part of the 31337 loyalty tier, and is working on a priority campaign. The report qualifies for: Base reward: $20,000 High-quality report: 1.15× Priority campaign: 1.30× 31337 loyalty tier: 1.15× Calculation: $20,000 × 1.15 × 1.30 × 1.15 = $34,385 The researcher receives $34,385 , compared with an illustrative historical reward of $6,000. Example 2: Exceptional Critical Vulnerability A researcher discovers an exceptional critical vulnerability in ChatGPT involving the compromise of all users' chat messages. The researcher is from the 31337 Loyalty Tier, working on a priority campaign target with a great submission, enabling OpenAI to fix the issue quickly. The report qualifies for: Base reward: $100,000 High-quality report: 1.15× Priority campaign: 1.30× 31337 loyalty tier: 1.15× Calculation: $100,000 × 1.15 × 1.30 × 1.15 = $171,925 Final reward: $171,925 This illustrates how researchers can earn substantial additional rewards by combining report quality, priority campaign participation, and loyalty bonuses. All examples and historical awards are illustrative. Final vulnerability ratings and rewards remain subject to OpenAI's discretion, as described in this policy. Our goal is to build stronger, long-term relationships with security researchers and encourage those who discover impactful vulnerabilities to continue helping keep OpenAI and its users secure.

Targets

Access to unreleased/private models We will accept reports of attacks in which you are able to send requests to (and receive output from) an OpenAI model that is private or unreleased (in other words, it is not mentioned in our API documentation nor available in the model picker). These will be eligible for a bounty, with severity determined by the sensitivity of the model in question. Credentials You may test with your personal account or sign up for an additional testing account using your @bugcrowdninja.com email address. We prefer testing using this email address, but it is not mandatory. Please note that authorized testing does not exempt you from all of OpenAI's terms of service. Abusing the service may result in rate limiting, blocking, or banning. Automated vulnerability scanners may trigger these outcomes. If your account or IP is rate-limited or blocked, please wait for the block to expire; we cannot manually remove it. If your account is banned, contact [email protected] to provide an explanation and request un-banning. We will only do this a limited number of times, at our discretion, and never for content violations. You will be removed from the program for repeated ban evasion. You will not be reimbursed for any upgrades or purchases made on your account. Application-layer prompt injection mitigations We welcome reports of prompt injection so long as they exploit a separate flaw in an in-scope OpenAI product or OpenAI-controlled integration. We are particularly interested in attacks that send sensitive data to an unauthorized recipient with little or no user interaction. Identify the restriction the application should enforce and use test data to show how the attacker bypassed it. If the agent took the action using permissions it already had and no separate product control failed, see the Safety Bug Bounty for eligibility and reporting instructions. Out-of-Scope The following are non-exhaustively out-of-scope: Model issues. See above. Attacks that may degrade, disrupt, or negatively impact services or user experience (e.g., denial of service, brute force, password spraying, spam, fuzzing, specifically unless authorized by OpenAI's security team). This includes brute forcing our APIs. Attacks that aim to destroy or corrupt data not belonging to you. Attacks that require the attacker to start with stolen or leaked credentials. Deliberately accessing data belonging to others, including confidential OpenAI data. If testing unexpectedly exposes such data, stop immediately, report how you found it without including its contents, and delete any copies you obtained. Use accounts and data you control to demonstrate impact. Physical, social engineering, phishing, or electronic attacks against OpenAI personnel, offices, wireless networks, or property. Any attacks on systems not explicitly mentioned as in-scope. Attacks related to email servers, protocols, security (e.g., SPF, DMARC, DKIM), or spam. Reports of insecure SSL/TLS ciphers without a working proof-of-concept. Reports of missing HTTP headers (e.g., lack of HSTS) without a working proof-of-concept. Clickjacking Reports of server error messages without proof of an exploit. Vulnerabilities impacting only old/end-of-life browsers/plugins. Reports relating to server version strings. Reports about verification tokens in ./well-known/ai-plugin.json . Attempts to get malicious code executed by posting internal package names (or close replicas of them) in public repos. Running Python or shell commands within the permissions of ChatGPT’s Code Interpreter sandbox. Discovery of names or references to unreleased products/features Specific examples that are out of scope: Domains (such as pay.openai.com ) which are CNAME'd to stripe. Please report issues to their program . Domains that are CNAME'd to other active third party service providers like community.openai.com . Unused subdomain takeovers are still in scope. Changing your password may not invalidate all Auth tokens and API Keys. The ability to add other users to your organization without their permission. Account deletion does not require password. API Keys have broad permissions and capabilities. You can make more API keys than the cap. Cookies can be transferred from one browser to another. ChatGPT displaying images from other domains. A report may qualify if loading an image bypasses an application restriction on who may receive sensitive data. Demonstrate the transfer with test data and a destination you control. The expected functionality of OpenGraph Tags (which request information from a rendered url in order to show a preview). Weird model behavior following "special" or "bugged" tokens. Certain overlong inputs can cause ChatGPT to produce what appear to be random or other people's answers. These are a specific form of model hallucination caused by a bug in ChatGPT which causes the model to be asked for a completion with a missing query. Reports that you can create accounts using online SMS services, without a detailed and specific description of a different security issue. Methods to bypass IP blocks or geoblock by changing your IP or using a VPN. Methods to bypass cloudflare on api.openai.com. Methods to bypass the ChatGPT is at capacity page. Methods to emulate a browser to bypass captchas. Websites which are not owned and operated by OpenAI, including ai.com and open.ai . Phishing websites, proxies for ChatGPT, discord bots, and other "free" websites which provide access the product. Changes to ChatGPT’s behavior caused solely by a third-party browser extension. The fact that you can share model presets by link on platform.openai.com/playground . Issues related to changing the email address sent to intercom. Issues related to billing lagging behind requests. Most issues relating to API rate limiting or API quota enforcement unless the bug allows complete bypass. We reward submissions that demonstrate a meaningful bypass of OpenAI rate limits or platform controls that enables sustained usage at significant scale beyond intended limits. Issues that don't scale to the order of hundreds of requests beyond enforced rate limits (e.g., one-off or low-volume bypasses) are considered out of scope for financial reward. Out of scope: temporarily exceeding the API requests-per-minute limit, the tokens-per-minute limit, or the hard spending cap. The fact that you can send shell commands to the Code Interpreter VM instance. Vulnerabilities in most of our dormant open source projects. We welcome reports (and patches) but typically will only reward for security issues with demonstrated impact in our actively maintained projects.

• Issues that require excessive user cooperation or unlikely social engineering, such as pasting code into browser developer tools, disabling browser protections, or sending information to the attacker out of band. Visiting an attacker-controlled page can qualify when the page bypasses a control covered by the in-app browser or official-extension rules. CVE Assignment OpenAI's CVE Assignment Policy explains how we handle vulnerability reports as a CVE Numbering Authority (CNA). This policy describes which types of security issues are in scope, how to submit reports, how CVE identifiers are assigned, and how we coordinate public disclosure. Learn more . Safe Harbor OpenAI will not threaten or bring any legal action against anyone who makes a good faith effort to comply with this bug bounty policy. This includes any claim under the DMCA for circumventing technological measures to protect the services and applications eligible under this policy. As long as you comply with this policy: We consider your security research to be "authorized" under the Computer Fraud and Abuse Act (and/or similar state laws), and We waive any restrictions in our applicable Terms of Use and Usage Policies that would prohibit your participation in this policy, but only for the limited purpose of your security research under this policy. OpenAI systems and services may be interconnected with third-party systems and services. If you submit a report through our bug bounty program that affects a third party service, we will limit what we share with the affected third party. Please understand that, while we can authorize your research on OpenAI’s systems and services, we cannot authorize your efforts on third-party products or guarantee they won’t pursue legal action against you. That said, if legal action is initiated by a third party against you because of your participation in this bug bounty program, and you have complied with our bug bounty policy, we will take steps to make it known that your actions were conducted in compliance with this policy. This is not, and should not be understood as, any agreement on our part to defend, indemnify, or otherwise protect you from any third party action based on your actions. You are expected, as always, to comply with all applicable laws. If you have concerns or are unsure whether your security research aligns with this policy, please contact [email protected] before proceeding.

ChatGPT Services (in scope)

The ChatGPT service is a mosaic of evolving applications. Examples of in-scope targets include ChatGPT Web Sites Spaces Images Health Finances These services have many security related surfaces, such as logins subscriptions OpenAI-created plugins (e.g. Browsing, Code Interpreter) plugins you create yourself Note : You are not authorized to conduct security testing on plugins created by other people.** If you have a conversation with ChatGPT to demonstrate your issue, please include the conversation ID, which can be found in the URL that appears in your address bar when the conversation is open. Examples of things we are interested in Stored or Reflected XSS CSRF SQLi Authentication Issues Authorization Issues Data Exposure Payments issues Methods to bypass Cloudflare protection by sending traffic to endpoints that are not protected by cloudflare Ability to run queries on pre-release or private models OpenAI created plugins: Browsing Code Interpreter Security issues with the plugin creation system: Outputs which cause the browser application to crash Credential security OAuth SSRF Methods to cause the plugin service to make calls to unrelated domains from where the manifest was loaded Model Related Issues For model related issues, please use the reporting channels discussed earlier. Model issues are strictly out of scope for the Security program and will not be rewarded. Hosted code execution Code Interpreter and Agent Mode run code inside OpenAI-hosted sandboxes. Running Python or shell commands within the session’s permissions is expected. In GPT-5 sessions that use the container tool, shell commands can run as root inside the gVisor sandbox. Reports that show only these expected capabilities are out of scope. To report a sandbox bypass, identify the tool and the restriction that applied in the supported configuration you tested. Use data you control to show what your code did beyond that restriction. Examples include: Reading another account’s file. In a private Code Interpreter session in test account A, create proof.txt with a random value. From a separate test account B that you control, show a Python file read that returns that value. Include both session IDs. Keep the file and its value out of account B’s prompts and attachments. Changing a read-only file. If the product gives the sandbox read-only access to a file you control, show the write that the sandbox normally denies. Use the bypass to change the file. Read it back from its original location outside the sandbox to confirm that the original changed. Reaching a blocked network destination. Show that the active sandbox policy denies a request to a server you control. Then use the bypass to send a request from code in the same sandbox to a unique path on that server, such as /bounty-test- . Include the tool call and the matching entry from your server’s access log. Running a command on the host. If the bypass lets you launch a host process, run a harmless command such as /bin/echo bounty-test- . Show what identifies the process as running on the host, such as a host-side process record containing that value. Include the session ID and timestamp so we can trace the command.

API Targets (in scope)

The following services and applications are in-scope: The OpenAI APIs Public cloud resources or infrastructure involved in serving the OpenAI API, including: cloud storage accounts (e.g., Azure data blobs). cloud compute servers (e.g., Azure virtual machines). As noted earlier, model safety and content issues are not eligible for reward in any of the categories.

ChatGPT Dots (in scope)

Overview Dots bug bounty focuses on vulnerabilities that let attackers compromise another user's Dot, access resources without authorization, or escape into OpenAI infrastructure. Security model: Assume an owner may obtain root inside their own Dot VM. Internal sandboxes are best-effort; the microVM-to-host boundary is hard. Severity follows demonstrated impact, not privileges alone. What We Care About Cross-user compromise — Unauthorized control of another person's Dot, files, tools, sessions, or connected accounts. Host and tenant isolation — VM-to-host escapes, access to other workloads, or disruption of shared infrastructure. Host denial of service (DoS) — The ability to crash a Dot host, rather than only a single VM. Critical infrastructure access — Unauthorized network access from a Dot to non-public OpenAI infrastructure, especially sensitive internal services. Cross-Dot network isolation — Unauthorized network access between Dots or VMs, or interference with other users' VMs or their networking. Generally Out of Scope Root or elevated privileges in your own Dot VM, without additional security impact. Known guest kernel or package CVEs, or Bubblewrap escapes, that remain contained within your own VM. Crashing only your own VM. Intentionally shared-Dot access or explicitly authorized user actions. Prompt injection or model manipulation without a demonstrated unauthorized security consequence. Important Distinctions Own VM vs. victim VM: Root in your own VM is generally out of scope. Unauthorized compromise of someone else's Dot is in scope. Sandbox vs. host: Inner sandbox escapes do not automatically merit a bounty. A VM-to-host escape breaks the critical isolation boundary. Reporting Expectations Show the attacker's starting access, the authorization boundary crossed, and concrete impact. Do not access real user data or disrupt shared infrastructure without explicit approval.

ChatGPT Desktop & Codex CLI (in scope)

This group covers ChatGPT Desktop , its in-app browser , Codex CLI, and the official ChatGPT browser extension for Chrome & Edge . It also covers OpenAI-controlled software that connects these components, controls the browser, or enforces their security restrictions. Valid reports must show which security control a less-privileged attacker bypassed and what that allowed the attacker to do. For example, if a web page escapes the in-app browser’s renderer sandbox and starts a shell on the user’s device, report the browser escape. The browser was responsible for containing the page. ChatGPT desktop and Codex CLI employ multiple sandboxing mechanisms. The sections below define the intended security properties and limitations of each sandbox technology. Sandbox for commands the model runs This sandbox covers commands the model issues through the normal sandboxed command tool in ChatGPT Desktop or Codex CLI. A report must demonstrate one of the filesystem, network, process, or operating-system violations described below. A file read alone by a model-issued command is out of scope, including a read outside the workspace. An attack that depends on the desktop client or CLI processing attacker-controlled files on the user’s filesystem is out of scope, as described below. In scope — the model’s command bypasses a sandbox restriction Identify the command, the restriction that applied in the supported configuration you tested, and the operation that succeeded. Filesystem writes. The command writes outside an authorized directory or modifies a file the active policy protects from changes, such as repository metadata or a file that stores credentials, approvals, or application state. Network. The command makes an outbound connection to a destination the active policy blocks for that command. Process or operating system. The command starts a prohibited process, gains a more privileged OS identity, accesses a protected system resource, or escapes an enforced process, account, or OS boundary. A command can create files to demonstrate a bypass. For example, the model creates a script in its writable workspace and runs it through the sandboxed command tool. If the script writes to a second directory that the active policy makes read-only, the report is in scope. Out of scope — attacker-controlled files, project startup, and client internals Attacker-controlled files on the user’s device. The attack depends on the desktop client, CLI, or command tool processing a repository or other file supplied by the attacker. This includes a repository the user clones or asks the app to fetch or merely inspect. Examples include malicious .git contents and projects with crafted file layouts or permissions. Project trust and client behavior. Bypassing the “Trust this project” prompt is out of scope. Other excluded paths include the client starting a repository-defined MCP server when a project opens or a CLI session starts, an updater running a repository-supplied hook, and an attacker calling client internals directly to launch a program. Helpers the client runs before sandboxing. An attack is out of scope if it requires the client to run an attacker-controlled launcher or helper before applying the sandbox, even if a sandboxed command created that file. In the script example above, this excludes both a helper that writes to the protected directory itself and one that weakens the restriction so the next command writes there. In-app browser and official extension Select the ChatGPT Desktop target for reports about the in-app browser or official extension. In scope — a browser or extension security control fails Sandbox escape. Content escapes an enforced renderer, browser, extension, application, or OS boundary. For example, previewing a downloaded document in the in-app browser lets the document escape the renderer sandbox. Commands from unauthorized callers. A website, another extension, or a local program can issue a command reserved for the browser, official extension, or desktop app. Show what the caller can read, change, or execute beyond its existing permissions. For example, an unrelated website impersonates the ChatGPT side panel and receives private text selected in another tab. Access across sites, accounts, profiles, or sessions. A flaw in an OpenAI browser component lets one site read or change another site’s private data, or lets a request authorized for one account, browser profile, or session access another that the product keeps separate. For example, a website embeds a signed-in page from another origin. A flaw in the extension gives the embedding website’s own JavaScript private text that the embedded site never shared with it. Sensitive data disclosure. A flaw in the browser, extension, or desktop app exposes credentials, session data, private page content, browsing history, screenshots, or local files despite an access or transfer restriction. For example, the user denies an upload to a site, but the browser’s file picker still gives that site the file. Misdirected uploads caused by prompt injection are out of scope when the agent uses existing permissions or a valid approval, even if the file contains sensitive data. File transfers and network access. Web content reads, uploads, downloads, or modifies local data beyond its permissions, bypasses a transfer’s source or destination restriction, or reaches a blocked local service or network destination. One example is a transfer that follows a redirect and delivers data to a denied origin. Out of scope — browser behavior within its permissions Permitted access and traffic. Examples include valid cross-origin requests, access through an authorized connected profile, and intentionally shared browser state. An extension may use its declared browser permission for an operation the caller is authorized to request and share the result only with an authorized recipient. The browser uses its own network permissions. To report a network bypass in the sandbox for model-run commands, show a command issued through the sandboxed tool reaching a destination its policy blocks. A download that only delivers the file. The browser downloads a repository archive. The attack succeeds only after the archive is extracted and Codex processes its malicious .git contents or runs a repository-supplied hook. The exclusion for attacker-controlled files applies. The extension blocks a request. A website sends a message to the extension. The extension rejects it before releasing private data or taking action for the website. ChatGPT reads an authorized tab. A user allows ChatGPT to read a tab that contains content embedded from another site. The snapshot returned to the user’s chat can include text displayed by that embedded site. ChatGPT uses an existing sign-in. A user authorizes ChatGPT to perform a task on a site using a connected browser profile. If that profile is already signed in to the site, ChatGPT can use that session for the authorized task. Upstream Chromium and Google Chrome — out of scope with one exception Vulnerabilities in upstream Chromium or Google Chrome that reproduce in an equivalent, unmodified upstream release are out of scope and should be reported to Google’s Chrome Vulnerability Reward Program . This exception applies only to Chromium bundled with the ChatGPT desktop app (formerly the Codex app). A previously disclosed Chromium vulnerability may be eligible only if all three conditions are met. More than seven calendar days have elapsed since Google published the corresponding Chrome Stable security fix. OpenAI has yet to publish a supported production release of the desktop app that fixes or effectively mitigates the vulnerability for the affected operating system and architecture. The report demonstrates a concrete High- or Critical-severity violation of an in-scope security boundary in the latest publicly available supported release of the desktop app. Reproduce the issue against the desktop app. A version number, CVE identifier, scanner result, or upstream proof of concept alone is insufficient. Independently installed browsers used with an official OpenAI browser extension fall outside this exception. Flaws introduced by OpenAI code, browser configuration, official extensions, or OpenAI-controlled product integrations remain in scope. In scope — approvals, credentials, and access controls Attacker-controlled content, including prompt injection, can trigger a flaw in one of these controls. The exclusions above also apply here. For example, an attack that requires Codex to load a malicious project file is out of scope even if the result is credential disclosure or an unauthorized action. Bypassing a required approval. Identify the built-in product rule, active user setting, or enforced administrator policy that requires approval before the specific action. Show which approval mode and prior grants applied, then demonstrate that the product completed the action without valid approval. Examples include: Codex CLI. With the user configured as reviewer and an active prompt rule for running gh pr view outside the sandbox, the model runs that command outside the sandbox before the user approves it. In-app browser. With approval required for new sites, automatic browser review off, and no grant for your test host, ChatGPT reads private content from your signed-in test page through the browser before you approve access to that host. Invalid or misapplied approval. The product accepts a forged, expired, or revoked approval, accepts a one-time approval twice, or honors a valid approval for the wrong actor, action, site, recipient, or context. Authentication secrets sent to the wrong recipient. A flaw that causes an OpenAI client to send an API key, OAuth access or refresh token, session cookie, or other authentication secret to a destination outside those permitted for that secret. For example, a signed-in user opens an attacker-controlled website in the in-app browser. A flaw in ChatGPT Desktop adds the user’s ChatGPT access token to the request’s Authorization header, exposing it to the website operator. Unauthorized access or action. An attacker uses untrusted content or a restricted component to bypass an enforced sandbox, browser, origin, account, profile, session, destination, or other authorization rule. The bypass lets the attacker execute code, obtain protected data, or perform an action beyond their authority. Administrator restrictions and disabled capabilities. An attacker bypasses an enforced administrator restriction or uses a capability the user or administrator disabled. For example, an administrator limits plugin marketplace sources to approved Git hosts. If Codex fetches a harmless marketplace repository from a host outside that list, the fetch itself demonstrates the bypass. Out of scope across this group Permitted actions and expected prompts. Actions and data access allowed by the active configuration are out of scope on their own. This includes actions covered by a valid saved grant or approved by an automatic reviewer authorized for that action. A missing dialog, the sensitivity of an action, or a request in chat such as “ask me before sending” is insufficient on its own to establish an approval bypass. Model behavior alone. Prompt injection, jailbreaks, hallucinations, misleading output, or misuse of existing access or valid, applicable approvals are out of scope unless the report also demonstrates a bypass of a security control in an in-scope OpenAI product or OpenAI-controlled integration. This exclusion applies even if the agent discloses sensitive data or performs an unwanted action. These reports may qualify under the separate Safety program. Social engineering alone. Examples include phishing, persuading someone to enter credentials, or convincing a user to approve an accurately described action without a separate implementation flaw. Existing device access alone. This includes user-installed malware, a compromised device, root or administrator access, or unrestricted code already running with the user’s authority. A report starting with that access must show which separate product or privilege boundary the attacker crossed. Third-party issues. A flaw confined to a third-party browser, website, extension, tool, or dependency is out of scope without an independent OpenAI-specific defect. The limited exception for bundled Chromium appears in the browser section above. Performance, hardening, and disruptive testing. Performance issues, speculative hardening suggestions, and other non-security bugs are out of scope. So are denial-of-service or resource-exhaustion attacks that require sustained, disruptive, or large-scale traffic. Supported configurations Reproduce the issue on a current, supported release in a documented, supported configuration. Test features available through a supported release, an authorized rollout, or a testing path OpenAI expressly identifies. Reports that reproduce only on unsupported or obsolete product versions are out of scope. A documented, supported optional feature is eligible when the report demonstrates a bypass of a restriction that applies with that feature enabled. Features listed in the Codex CLI /experimental menu are ineligible for rewards whether enabled through that menu or in config.toml . If you choose unrestricted execution, disable a protection, or grant a capability, identify a restriction that still applies and show how the attack bypasses it. This includes restrictions enforced by an administrator. UI-only findings — P5 unless the impact is P1 Visual impersonation, misleading origin displays, and similar UI-only findings in the in-app browser or OpenAI’s first-party desktop and extension interfaces are P5 (Informational) unless they demonstrate P1 (Critical) impact. The P1 assessment depends on the impact you demonstrate, such as direct exposure of sensitive data, remote code execution, or an action beyond the user’s authority. You may submit P5 findings. They carry no monetary reward or commitment to a response or remediation timeline. Safe testing and reporting Use only accounts, devices, browser profiles, websites, extensions, and data you own or are authorized to test. You may use your own sites and ordinary supported workflows. Stop once you demonstrate the issue. Do not access another person’s data, make real purchases, take destructive actions, disrupt services, or attack OpenAI personnel or unrelated third parties. Include the product and version, OS, active configuration, relevant permissions and approvals, and reproduction steps. Identify the attacker’s starting access, the restriction that applied, the protected resource or action, and the unauthorized result. For model-assisted exploits, name the control that failed in the product, bundled browser, or OpenAI-controlled integration.

Other OpenAI Targets (in scope)

This target group includes: The OpenAI.com website. The OpenAI Developer Documentation. OpenAI Research Org Targets Any other Internet-facing infrastructure operated by OpenAI and not specified in another target. Any other public cloud resources or infrastructure operated by OpenAI.

Third Party Corporate Targets (in scope)

This target group consists of confidential OpenAI corporate information that may be exposed through third parties. Some examples of the types vendors which would qualify in this category include: Google Workspace Asana, Trello, Jira, Monday.com Notion, Confluence, Evernote Intercom, Hubspot, Zendesk Stripe, Airbase, Navan Mode, Charthop, Looker You may report confidential OpenAI information exposed in a public source or a source you are already authorized to view. You are not authorized to perform additional security testing against these companies. Follow applicable law and the provider's terms of service. Do not test the provider's systems. The providers listed above are examples and may have no business relationship with OpenAI. Stop as soon as the exposure is visible. Report where and how you found it without including confidential contents. Do not open additional documents, download files, or search for more records to establish the extent of the exposure. Individual document exposures are typically rated P4 or P5 and receive no monetary reward at those priorities. Particularly sensitive information may warrant a higher rating in rare cases. If the evidence already visible shows that one flaw exposed multiple documents, we may take that into account when setting the reward.

OpenAI API Keys (in scope)

API Key Security Initiative for OpenAI Our customers occasionally post their API keys on the internet. We need your help to keep them safe. Once a month, we award one bonus through Bugcrowd to the researcher with the most impactful eligible submission of publicly exposed customer API keys. We consider only the first report of each key. The displayed P1 range does not apply to individual key reports. We contact the recipient directly. Please do not ask Bugcrowd Support for status updates. Submit exposed keys only through the OpenAI API Key Bug Bounty Submission Form . Do not use a key to test whether it works. Submitting a key through Bugcrowd results in an out-of-scope report and a point deduction. Do not post or share OpenAI API keys online. Valid OpenAI API Keys have the prefix sk- or sess- Any submission that does not adhere to this format will be rejected. Additional Things to Avoid: Please don't submit the same keys repeatedly. Don't create keys just to submit them. Don't submit keys one-by-one - we can handle them in bulk. Creating multiple accounts or generating many API keys for a single account is a violation of our terms. This may result in account suspension. Play nicely. We keep a close eye on everything. Make sure that you act responsibly. Thank you for your assistance! This form is temporary - we will create an API for this soon. Submit all findings here: OpenAI API Key Bug Bounty Submission IMPORTANT Do not submit API keys to bugcrowd. The submission will be marked as out of scope and you will lose points. You must submit through the form.