cyber.hendryadrian.com
Security News · securityweek.com

OpenAI Launches Bug Bounty Program for AI Safety and Abuse Risks

· Original article ↗

Summary

OpenAI launched a public safety bug bounty program covering AI-specific abuse risks, including third-party prompt injection, data exfiltration, agent misuse, and harmful connector or MCP integrator flaws. Eligible high-severity reports may earn up to $7,500.

Key points

  • The new program complements OpenAI’s existing security bug bounty and covers issues that may not qualify as security vulnerabilities.
  • Scope includes third-party prompt injection and data exfiltration, harmful actions by agentic products, abuse-protection bypasses, proprietary-information exposure, and account or platform integrity weaknesses.
  • Researchers are encouraged to report risks in products including Atlas Browser, Codex, Operator, Connectors, and other ChatGPT tools.
  • Connector and MCP integrator flaws that can be abused to cause material harm are eligible.
  • OpenAI says consistently reproducible, high-severity reports with clear remediation steps may receive up to $7,500; reward decisions and amounts remain at its discretion.
  • Submissions run through Bugcrowd and may be rerouted between OpenAI’s safety and security bounty teams based on scope and ownership.

Article Details

Event Type
OpenAI launched a public safety bug bounty program focused on AI-specific abuse and safety risks.
Impact
The program accepts reports on issues including third-party prompt injection and data exfiltration, harmful actions by agentic products, exposure of proprietary information, and account or platform integrity weaknesses. Eligible high-severity reports may receive up to $7,500, at OpenAI’s discretion. The article reports no specific incident or realized harm.

Vendors

BugcrowdThe program runs on Bugcrowd and follows the same rules as the company’s security bug bounty program, with several additions.OpenAIOpenAI has announced a new public safety bug bounty program focused on AI-specific abuse and safety risks in its products.

Products

Atlas BrowserOpenAI products that perform actions on behalf of the user or access data as the user, including Atlas Browser, Codex, Operator, Connectors, and other ChatGPT tools.ChatGPTof the user or access data as the user, including Atlas Browser, Codex, Operator, Connectors, and other ChatGPT tools.Codexproducts that perform actions on behalf of the user or access data as the user, including Atlas Browser, Codex, Operator, Connectors, and other ChatGPT tools.Connectorsactions on behalf of the user or access data as the user, including Atlas Browser, Codex, Operator, Connectors, and other ChatGPT tools.Operatorthat perform actions on behalf of the user or access data as the user, including Atlas Browser, Codex, Operator, Connectors, and other ChatGPT tools.

Related Articles