OpenAI NewsMar 25, 2026, 08:00 UTC+8

Introducing the OpenAI Safety Bug Bounty program

OpenAI launched a public Safety Bug Bounty on March 25, 2026 for AI abuse and safety issues across its products. Scope includes agentic risks, proprietary information exposure, and account or platform integrity; third-party prompt injection must reproduce at least 50% of the time. This is not a jailbreak bounty: generic policy bypasses are out of scope.

Why it matters: This clears HKR-H/K/R: the public AI-safety bounty is novel, the post gives testable scope rules, and builders care about the reporting boundary. It stays in the low featured band because this is a governance/process update, not a model or capability launch.

Read the original ↗Export Markdown

Take

OpenAI is turning safety reports into engineering tickets, not vibes. The hard line is the 50% reproducibility bar for third-party prompt injection against Browser, ChatGPT Agent, and similar agentic products. That filters out jailbreak screenshots and admits the stuff that hurts: agent hijack, data exfiltration, MCP exposure, account-trust abuse, and platform-integrity bypasses. Generic policy bypasses are explicitly out; biorisk still sits in private campaigns for ChatGPT Agent and GPT-5.

I like the scoping. It matches where agents have been breaking in the wild: tool use, credentials, browser state, and trust signals. The weak spot is incentives. The post names Bugcrowd and the categories, but gives no payout range here. Without serious rewards, the people who can build reliable agent exploits will sell attention elsewhere or keep findings private.

Source: OpenAI News · openai.com
Published: Mar 25, 2026, 08:00 UTC+8 · Mar 25, 2026