OpenAI launches Safety Bug Bounty program

The launch of the Safety Bug Bounty reflects OpenAI's recognition that AI safety risks extend beyond traditional security flaws. While the Security Bug Bounty covers conventional vulnerabilities, this new program addresses issues like third-party prompt injection, where attacker text can hijack an AI agent to perform harmful actions or leak sensitive data—a risk growing with the rise of agentic products. By inviting researchers to report such issues, OpenAI aims to catch problems that automated testing might miss.

The program's scope is carefully defined: agentic risks must be reliably reproducible, and reports must indicate plausible material harm. Jailbreaks, such as those causing rude language, are out of scope. This structure suggests OpenAI is focusing on concrete, high-impact risks rather than general content-policy bypasses.

The stakes center on the program's ability to surface actionable vulnerabilities. Its success hinges on whether the community can provide reproducible examples of abuse, which could inform future safeguards. This initiative likely signals a broader industry shift toward proactive, researcher-driven safety testing as AI capabilities expand.