Safety Bug Bounty

Description

We’re pleased to announce that we are launching a new Bug Bounty Program for select safety and abuse issues. As AI technology rapidly evolves, so do the potential ways it can be misused. We believe it’s essential to recognize and reward responsible disclosures involving critical safety and abuse scenarios. Program Rules In addition to the existing OpenAI Security Bug Bounty rules , the following rules apply: Qualifying issues must represent a design or implementation issue in an active OpenAI product that can be abused by an attacker to cause material harm. Reports must be addressable via a clear set of recommended steps or mitigations. The goal of this program is to reward for bug fixes and we cannot reward requests for general product improvements. Qualifying issues must be consistently reproducible. Researchers should provide enough steps and evidence to reproduce the issue reliably under typical conditions. We may accept partial or probabilistic exploits if the result is still high impact, but the burden of proof is on the researcher to demonstrate it is not a one-off fluke. We only reward for issues that have not already been submitted to us. Any accounts used as victims must be test accounts owned by the researcher. Any testing that affects accounts, assets, or services owned by others is strictly prohibited. Vulnerability testing must not risk damage or compromise to any real-world accounts. For example, prompt injection text should not be hosted on public surfaces discoverable by real users or their agents. Final reward decisions and amounts are up to OpenAI discretion, especially when applied to safety issues.

Targets

Test Accounts Safety and abuse testing may result in account enforcement including bans. Please use test accounts in your bughunting to ensure no complications with your personal account. Please note that authorized testing does not exempt you from all of OpenAI's terms of service. Abusing the service may result in rate limiting, blocking, or banning. Automated vulnerability scanners may trigger these outcomes. If your account or IP is rate-limited or blocked, please wait for the block to expire; we cannot manually remove it. You will not be reimbursed for any upgrades or purchases made on your account. Safe Harbor OpenAI will not threaten or bring any legal action against anyone who makes a good faith effort to comply with this bug bounty policy. This includes any claim under the DMCA for circumventing technological measures to protect the services and applications eligible under this policy. As long as you comply with this policy: We consider your safety and security research to be "authorized" under the Computer Fraud and Abuse Act (and/or similar state laws), and We waive any restrictions in our applicable Terms of Use and Usage Policies that would prohibit your participation in this policy, but only for the limited purpose of your safety and security research under this policy. OpenAI systems and services may be interconnected with third-party systems and services. If you submit a report through our bug bounty program that affects a third party service, we will limit what we share with the affected third party. Please understand that, while we can authorize your research on OpenAI’s systems and services, we cannot authorize your efforts on third-party products or guarantee they won’t pursue legal action against you. That said, if legal action is initiated by a third party against you because of your participation in this bug bounty program, and you have complied with our bug bounty policy, we will take steps to make it known that your actions were conducted in compliance with this policy. This is not, and should not be understood as, any agreement on our part to defend, indemnify, or otherwise protect you from any third party action based on your actions. You are expected, as always, to comply with all applicable laws. If you have concerns or are unsure whether your safety and security research aligns with this policy, please contact [email protected] before proceeding.

Agentic Tools Including MCP (in scope)

Abuse risks in our agentic products, defined as any product that 1) performs an action on behalf of the user or 2) accesses data as the user. This includes Atlas Browser, Codex, Operator, Connectors, and other agentic ChatGPT tools. Reports that detail issues that exist solely in third-party services that do not result in OpenAI-side remediation are out of scope. Ensure your tests attack only your own test accounts, never agents operated by real users. Connectors and MCP (Model Context Protocol) integrations expand an agent’s ability to access and act on data in external systems (e.g., reading content, searching, creating/updating records, sending messages, or retrieving files). These integrations are in scope when a vulnerability in OpenAI systems, configuration, permissioning, confirmation UX, or integration logic can be abused to cause material harm (e.g., unauthorized data access, cross-tenant data exposure, or harmful actions performed under the victim’s account). In Scope: Indirect / third-party prompt injection or untrusted-content attacks that cause an agent to misuse a Connector or MCP tool to access, exfiltrate, or transform sensitive data from a bughunter-owned “victim” account, or to take a harmful action under that account. For the purposes of our bug bounty rewards program, extracting personally identifiable information from a user’s chat history counts as sensitive private data. Prompt injections must meet a minimum bar for realism and feasibility; reports that rely on victims running clearly malicious or dangerous commands are not eligible for rewards. In Scope: Authorization or permission bypasses where an agent can access Connector/MCP data or perform Connector/MCP actions beyond what the user, workspace, or app integration permissions should allow (including cross-workspace or cross-tenant data exposure). In Scope: Vulnerabilities that cause agents to perform tool actions without appropriate user understanding/confirmation, or where confirmations are materially misleading relative to what will be accessed/sent/done (especially for high-impact actions like sharing/exporting data, changing settings, or posting/sending messages). In Scope: Misusing an agentic tool to perform a disallowed action: creating new OpenAI user accounts at scale (at least 10 accounts without human interaction). Out of Scope: Reports that detail issues that exist solely in third-party services that do not result in OpenAI-side remediation. For example, issues caused by poorly annotated third-party MCP servers are not in scope. Out of Scope: Testing that requires accessing accounts, tenants, or data you do not own or do not have explicit authorization to test.

OpenAI Proprietary Information (in scope)

Vulnerabilities or model issues that return OpenAI internal information, intellectual property, or otherwise confidential data. In Scope: Vulnerabilities that return proprietary information related to reasoning (e.g., full unsummarized Chain of Thought). In Scope (already covered by the existing Security Bug Bounty scope): Vulnerabilities that enable the exposure of other OpenAI proprietary information (e.g. insider information) — report via the Security Bug Bounty. Out of Scope: Model responses that appear to expose internal OpenAI proprietary information. Out of Scope: System prompts, or any other information present in the model context window at inference time except for CoTs.

Account and Platform Integrity (in scope)

The ability to bypass our safeguards against abuse on our platform. We reward submissions that demonstrate a meaningful bypass of OpenAI rate limits or platform controls that enables sustained usage at significant scale beyond intended limits. Findings that do not demonstrate a scalable bypass of rate limits are out of scope for financial reward. Rate limit bypass issues must demonstrate at least 1,000 completions from the latest model generation across no more than five accounts within one day on our Sol model (any reasoning level). In Scope: Vulnerabilities in our account integrity and platform integrity signals, e.g., automating mass creation of OpenAI accounts. Again, for conversation rate limit bypasses, these issues must demonstrate at least 1,000 completions from the latest model generation across no more than five accounts within one day on our Sol model (any reasoning level). In Scope (already covered by the existing Security Bug Bounty scope): Exploits that allow users to access features, data, or functionalities beyond their authorized permissions — report via the Security Bug Bounty. Out of Scope: Evading controls around geographic access restrictions. Out of Scope: Testing that facilitates genuine fraud or requires social engineering, e.g., creating fraudulent OpenAI Startup Fund accounts.

Other Novel Abuse (in scope)

In scope Outside of the examples listed above, if your report contains a flaw that facilitates a direct path to user harm and actionable, discrete remediation steps, we may still consider it in scope for rewards on a case-by-case basis .

Content Issues (out of scope)

Out of scope The model generates responses that violate OpenAI’s policy on disallowed content. All content/model response issues are out of scope — these issues are complex and not addressable through traditional security fixes.