Summary: OpenAI made its Safety Bug Bounty official on March 26 through Bugcrowd, targeting prompt injection, data exfiltration, unpermitted agent actions, and other harmful behaviors that are not conventional software vulnerabilities. Named targets include Atlas Browser, Codex, Operator, Connectors, and other ChatGPT tools, with high-severity reports eligible for up to $7,500 when reproducible and accompanied by mitigation advice. OpenAI says safety and security triage teams can transfer cases, while final reward decisions remain discretionary.
OpenAI’s Safety Bug Bounty program became official on March 26, with SecurityWeek and other outlets carrying the story the following day. Do not file it under conventional security bounties. The program is hosted on the Bugcrowd platform, and its targets are AI abuse and safety risks that would fail every definition of a security vulnerability: prompt injection planted by third parties, data exfiltration attacks, and agent products carrying out improper actions while operating on a user’s behalf.
For developers, nothing like this has come from a frontier lab before: “behavioral AI risk” now runs through a formal reporting pipeline with triage and set prices. Once agent products are deployed at scale, the attack surface is no longer memory corruption but “the model did something it should not have,” and this program effectively lays down the industry’s first draft of a taxonomy for that problem class.
What Counts: Rewards for Risks That Are Not Security Bugs
As described in the announcement, several categories that vulnerability programs habitually turn away now sit inside the payout scope:
- Prompt injection coming from third parties, alongside data exfiltration attacks
- Unpermitted actions carried out at scale by OpenAI’s agentic products, together with other harmful product behaviors
- OpenAI proprietary information being exposed, plus flaws in account and platform integrity
- Design or implementation issues capable of causing material harm, bypasses of abuse protections among them
- Vulnerabilities in connectors and MCP integrators where they can be abused to cause material harm
The targets called out by name all act for users or reach user data: Atlas Browser, Codex, Operator, Connectors, and other ChatGPT tools.
Payout Ceiling and What a Report Needs
The maximum payout is $7,500, reserved for high-severity issues that reproduce consistently and reported with a clear set of recommended steps or mitigations. OpenAI states that the final reward — and whether one is granted at all — is a discretionary call. Flaws opening a “direct path to user harm” can still be rewarded case by case when concrete, executable remediation steps come attached.
Put plainly, the currency is not the discovery itself but the write-up: a finding earns once it exists as reproducible, fixable engineering documentation. A fuzzy “the model performed poorly,” or a one-off anomaly that cannot be recreated, will not clear the bar. Against mainstream bounty programs the payouts look small; the real weight sits in the classification, because OpenAI is declaring that behavioral failures in deployed agents have become a class of defect that can be found, priced, and fixed.
The Bullseye Sits on Agentic Products
Spread the named-product list out and the focus is unmistakable: the risk concentrates where “the model operates a computer for you.” Operator handles web browsing, Codex works inside repositories, Connectors hook into third-party services through MCP. None of these scenarios requires an attacker to breach software — it is enough for malicious content to slip into the context as text, and the agent may carry out the action the attacker had in mind.
That is exactly why MCP integrators are spelled out in scope: one connector with a vulnerability stretches the attack surface across every ChatGPT user who attaches it. Drawing the responsibility boundary out to third-party integrations, OpenAI is telling the agent ecosystem that implementation quality on the integration side is platform risk. Ship an MCP server or connector that ChatGPT users can reach, and you are effectively auditioning for a place inside OpenAI’s security perimeter.
How the New Program Divides Work With the Existing Security Program
The existing, long-running OpenAI bug bounty continues to own traditional software vulnerabilities; the new program adopts those same rules plus several additions. Triage is a shared job: the Safety and Security Bug Bounty teams classify submissions together, and a report can be handed off between the two programs, so a finding spanning security and abuse will not be rejected as out of scope.
Alongside these sits the separate Bio Bug Bounty for biosecurity risks. Three channels now map to three risk classes: classic vulnerabilities, product abuse, and biosecurity.
The Takeaway for Developers and Security Teams
Three practical consequences. First, teams building agents or MCP services gain a formal reporting channel plus an official working list of what counts as “material harm” — material they can adopt directly as the premise of their threat models. Second, the reward level is conservative ($7,500 at high severity), and community critics already question whether the program’s actual willingness to pay, at these amounts, can draw in top-tier researchers; whether it becomes an effective defensive layer will be settled by the payout record. Third, hard-coding “reproducibility plus mitigation advice” as the gate pushes AI safety reporting toward engineering discipline: vague policy complaints carry no price, while attack paths that can be reproduced and fixed do.