{"id":"2ccc3cfa-6f57-4f4d-bb9b-a383df1db634","engagementId":"3a92991c-f94a-4f00-8053-49418ab93629","data":{"brief":{"id":"9ce996a5-3edc-477f-ba5d-8c4ed4eb8eec","name":"OpenAI","tagline":"OpenAI is an AI research and deployment company. Our mission is to ensure that artificial general intelligence benefits all of humanity.","description":"\u003ch1\u003eOpenAI Security Bug Bounty Policy\u003c/h1\u003e\n\n\u003cp\u003e\u003cstrong\u003eIMPORTANT: MODEL SAFETY ISSUES ARE OUT OF SCOPE\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eFindings limited to model behavior, including jailbreaks, hallucinations, and prompt-based safety bypasses, are out of scope for OpenAI's Security Bug Bounty.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eSee section 3 before submitting a model-related report.\u003c/strong\u003e A model-assisted attack can qualify here if it exploits a separate flaw in an in-scope OpenAI product or OpenAI-controlled integration.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch1\u003etl;dr of what's included in the new bug bounty program\u003c/h1\u003e\n\n\u003cp\u003e💰 Higher payouts: More than 4x higher reward midpoints on average for medium, high, and critical vulnerabilities.\u003cbr\u003e\n🎯 Quality bonuses: Earn additional rewards for high-quality reports with strong proof of concepts.\u003cbr\u003e\n🏆 Loyalty program: A new 5-tier program rewarding researchers for consistently finding valid vulnerabilities.\u003cbr\u003e\n🔥 Priority campaigns: Additional bonus multipliers for vulnerabilities found during special campaigns.\u003cbr\u003e\n💎 Stackable bonuses: Exceptional findings can now earn up to $172,000 with bonuses!\u003c/p\u003e\n\n\u003cp\u003eFor details on bonuses, see \u003cstrong\u003eResearcher Rewards and Multipliers\u003c/strong\u003e.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch1\u003eWelcome\u003c/h1\u003e\n\n\u003cp\u003eSecurity is essential to OpenAI's mission. We appreciate the contributions of ethical hackers who help us uphold high privacy and security standards for our users and technology.\u003c/p\u003e\n\n\u003cp\u003eThis policy, based on \u003ca href=\"https://disclose.io\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003edisclose.io\u003c/a\u003e, outlines our definition of good faith regarding the discovery and reporting of vulnerabilities and clarifies what researchers can expect from OpenAI in return.\u003c/p\u003e\n\n\u003ch2\u003eVulnerability Ratings and Rewards\u003c/h2\u003e\n\n\u003cp\u003eThe initial priority rating for most findings will use the \u003cstrong\u003eBugcrowd Vulnerability Rating Taxonomy (VRT)\u003c/strong\u003e.\u003c/p\u003e\n\n\u003cp\u003eHowever, vulnerability priority and rewards may be modified based on likelihood or impact at OpenAI's sole discretion. In cases of downgraded issues, researchers will receive a detailed explanation.\u003c/p\u003e\n\n\u003cp\u003eUse the applicable scope group to find the base reward for a qualifying vulnerability. For the core product groups, the exceptional Critical amount is a base award. See \u003cstrong\u003eResearcher Rewards and Multipliers\u003c/strong\u003e for applicable bonuses. You may still report Low (P4) and Informational (P5) findings, but those priorities do not carry a base bounty. \u003c/p\u003e\n\n\u003cp\u003eNote that the \u003cstrong\u003eOpenAI API Keys\u003c/strong\u003e group has separate rules for its monthly award.\u003c/p\u003e\n\n\u003ch1\u003e1. Our Commitments to Researchers\u003c/h1\u003e\n\n\u003cp\u003eAs part of this policy, OpenAI commits to:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eSafe Harbor:\u003c/strong\u003e Provide Safe Harbor protection, as outlined below, for vulnerability research conducted according to these guidelines.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eCommunication:\u003c/strong\u003e Cooperate with researchers in understanding and validating their reports, ensuring a prompt initial response.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRemediation:\u003c/strong\u003e Remediate validated vulnerabilities in a timely manner.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRecognition:\u003c/strong\u003e Acknowledge and credit researchers who are first to report a unique vulnerability that leads to a code or configuration change.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch1\u003e2. Rules of Engagement\u003c/h1\u003e\n\n\u003cp\u003eResearchers are authorized to perform security testing in compliance with this policy.\u003c/p\u003e\n\n\u003cp\u003eTo help distinguish good-faith security research from malicious activity, researchers must follow these rules.\u003c/p\u003e\n\n\u003ch2\u003e2.1 Authorized Testing\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eYou are authorized to perform testing in compliance with this policy.\u003c/li\u003e\n\u003cli\u003eFollow this policy and any other relevant agreements. In case of inconsistency, this policy takes precedence.\u003c/li\u003e\n\u003cli\u003eTest only in-scope systems and respect out-of-scope systems.\u003c/li\u003e\n\u003cli\u003eInteract only with your own accounts unless authorized by OpenAI.\u003c/li\u003e\n\u003cli\u003eRefrain from violating privacy, disrupting systems, destroying data, or harming user experience.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003e2.2 Data Protection\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eDo not access, modify, or use data belonging to others, including confidential OpenAI data.\u003c/li\u003e\n\u003cli\u003eIf a vulnerability exposes such data, stop testing immediately. Report where and how you found it without including its contents. Do not retrieve additional records to demonstrate impact. Delete any copies you obtained and use accounts and data you control to demonstrate the issue.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003e2.3 Reporting and Disclosure\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003ePromptly report discovered vulnerabilities.\u003c/li\u003e\n\u003cli\u003eUse this Security Bug Bounty for vulnerability reports and related communication. Submit publicly exposed customer API keys only through the \u003ca href=\"https://forms.gle/h8bQ5YKWzXb8FtrQ8\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eOpenAI API Key Bug Bounty Submission Form\u003c/a\u003e. If an in-scope OpenAI product flaw exposes keys, report the flaw here and redact all key values, including in attachments.\u003c/li\u003e\n\u003cli\u003eKeep vulnerability details confidential until authorized for release by OpenAI's security team, which aims to provide authorization within 90 days of report receipt.\u003c/li\u003e\n\u003cli\u003eDisclosure of vulnerabilities to OpenAI must be unconditional. Do not engage in extortion, threats, or other tactics to elicit a response under duress. OpenAI denies Safe Harbor for vulnerability disclosure conducted under such circumstances.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch1\u003e3. Model Issues and Out-of-Scope Vulnerabilities\u003c/h1\u003e\n\n\u003cp\u003e\u003cstrong\u003eIMPORTANT: READ BEFORE SUBMITTING MODEL-RELATED REPORTS\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eOpenAI is committed to \u003ca href=\"https://openai.com/blog/our-approach-to-ai-safety\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003emaking AI safe and useful for everyone\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003eBefore releasing a new system, we thoroughly test it, get expert feedback, improve its behavior, and set up safety measures. While we work hard to prevent risks, we cannot predict every way people will use or misuse our technology in the real world.\u003c/p\u003e\n\n\u003cp\u003eFor a model-assisted attack such as prompt injection, identify the control the in-scope OpenAI product or OpenAI-controlled integration should have enforced. Use test data to show the unauthorized access, disclosure, or action. For example, show how an attacker caused private data to be sent to a recipient the application should have blocked.\u003c/p\u003e\n\n\u003cp\u003eIf an agent misuses permissions it already has and no separate product control failed, see \u003cstrong\u003eReporting Model-Related Issues\u003c/strong\u003e.\u003c/p\u003e\n\n\u003ch2\u003e3.1 Model Safety Issues\u003c/h2\u003e\n\n\u003cp\u003eThe following are out of scope:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eJailbreaks and safety bypasses (e.g., DAN and related prompts).\u003c/li\u003e\n\u003cli\u003eGetting the model to say bad things to you.\u003c/li\u003e\n\u003cli\u003eGetting the model to tell you how to do bad things.\u003c/li\u003e\n\u003cli\u003eGetting the model to write malicious code for you.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003e3.2 Model Hallucinations\u003c/h2\u003e\n\n\u003cp\u003eModel hallucinations are also out of scope, including:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eGetting the model to pretend to do bad things.\u003c/li\u003e\n\u003cli\u003eGetting the model to pretend to give you answers to secrets.\u003c/li\u003e\n\u003cli\u003eGetting the model to pretend to be a computer and execute code.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch1\u003e4. Reporting Model-Related Issues\u003c/h1\u003e\n\n\u003cp\u003eReport a demonstrated bypass of an in-scope OpenAI product control, including an eligible sandbox escape, through this Security Bug Bounty. If attacker-controlled content causes an agent to disclose sensitive data or take a harmful action using permissions it already has, check the \u003ca href=\"https://bugcrowd.com/engagements/openai-safety\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eSafety Bug Bounty\u003c/a\u003e for eligibility.\u003c/p\u003e\n\n\u003cp\u003eFor general feedback on a model response, use the thumbs-down control in ChatGPT or, if your organization has enabled feedback, in the API Playground.\u003c/p\u003e\n\n\u003cp\u003eFor model-related issues, please use:\u003c/p\u003e\n\n\u003cp\u003e\u003ca href=\"https://openai.com/form/model-behavior-feedback\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eOpenAI Model Behavior Feedback\u003c/a\u003e\u003c/p\u003e\n\n\u003cp\u003eOpenAI will provide Safe Harbor protection, as outlined below, for model issues research conducted in accordance with this policy.\u003c/p\u003e\n\n\u003ch3\u003eAcademic Research\u003c/h3\u003e\n\n\u003cp\u003eIn some very limited cases, OpenAI may reward academic research related to:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eModel safety.\u003c/li\u003e\n\u003cli\u003eDisclosure of model weights.\u003c/li\u003e\n\u003cli\u003eTraining data.\u003c/li\u003e\n\u003cli\u003eRelated concerns.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003ePlease submit research papers to \u003cstrong\u003edisclosure@openai.com\u003c/strong\u003e for consideration.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch1\u003e5. Researcher Rewards and Multipliers\u003c/h1\u003e\n\n\u003cp\u003eOpenAI recognizes researchers who submit high-quality vulnerability reports and consistently contribute to improving our security.\u003c/p\u003e\n\n\u003cp\u003eOur rewards structure includes:\u003c/p\u003e\n\n\u003col\u003e\n\u003cli\u003e\n\u003cstrong\u003eReport-quality multipliers:\u003c/strong\u003e Additional rewards for particularly useful, high-quality submissions.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003ePriority campaign multipliers:\u003c/strong\u003e Increased rewards for research on selected targets or campaigns.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eResearcher loyalty bonuses:\u003c/strong\u003e Additional payouts for researchers with a sustained history of valid, impactful submissions.\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003cp\u003eThese adjustments are separate from the underlying vulnerability priority and impact, which determine the initial award.\u003c/p\u003e\n\n\u003ch2\u003e5.1 Report Quality and Campaign Multipliers\u003c/h2\u003e\n\n\u003cp\u003eMultipliers may adjust a vulnerability's base reward based on report quality or participation in a designated research campaign.\u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eCategory\u003c/th\u003e\n\u003cth\u003eMultiplier\u003c/th\u003e\n\u003cth\u003eDescription\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eLow-quality report\u003c/td\u003e\n\u003ctd\u003eUp to 0.85×\u003c/td\u003e\n\u003ctd\u003eDifficult to understand; requires significant follow-up to identify and remediate the issue\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eStandard-quality report\u003c/td\u003e\n\u003ctd\u003e1.00×\u003c/td\u003e\n\u003ctd\u003eSufficient information to reproduce and evaluate the vulnerability\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eHigh-quality report\u003c/td\u003e\n\u003ctd\u003eUp to 1.15×\u003c/td\u003e\n\u003ctd\u003eClear proof of concept, precise prerequisites, useful evidence, and accurate impact analysis\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003ePriority campaign\u003c/td\u003e\n\u003ctd\u003eUp to 1.30×\u003c/td\u003e\n\u003ctd\u003eTime-limited research targeting difficult or strategically important systems\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003ch3\u003eHow Multipliers Work\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eOnly one quality multiplier and one campaign multiplier may apply to a submission.\u003c/li\u003e\n\u003cli\u003eQuality and campaign multipliers can be combined.\u003c/li\u003e\n\u003cli\u003eAn incomplete report remains in \u003cem\u003eNeeds More Information\u003c/em\u003e until it meets the minimum submission standard.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eCore award = Base reward × Quality multiplier × Campaign multiplier\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eWe calculate the loyalty bonus as a percentage of the core award and add it to that award. For example, a 15% loyalty bonus brings the total to 1.15 times the core award.\u003c/p\u003e\n\n\u003ch2\u003e5.2 Researcher Loyalty Program\u003c/h2\u003e\n\n\u003cp\u003eOur five-tier loyalty program recognizes researchers who consistently identify valid, impactful security vulnerabilities.\u003c/p\u003e\n\n\u003cp\u003eAs researchers make meaningful contributions, they can qualify for higher loyalty tiers and additional rewards on future valid submissions.\u003c/p\u003e\n\n\u003cp\u003eLoyalty bonuses are separate from report-quality and campaign multipliers.\u003c/p\u003e\n\n\u003ch3\u003eLoyalty Tiers\u003c/h3\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eLoyalty tier\u003c/th\u003e\n\u003cth\u003eAdditional reward\u003c/th\u003e\n\u003cth\u003eQualification\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cstrong\u003eStandard\u003c/strong\u003e\u003c/td\u003e\n\u003ctd\u003e0%\u003c/td\u003e\n\u003ctd\u003eNew researchers or insufficient program history\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cstrong\u003eBronze\u003c/strong\u003e\u003c/td\u003e\n\u003ctd\u003e+5%\u003c/td\u003e\n\u003ctd\u003eAt least 3 impact points over the trailing 12 months\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cstrong\u003eSilver\u003c/strong\u003e\u003c/td\u003e\n\u003ctd\u003e+7.5%\u003c/td\u003e\n\u003ctd\u003eAt least 10 impact points\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cstrong\u003eGold\u003c/strong\u003e\u003c/td\u003e\n\u003ctd\u003e+10%\u003c/td\u003e\n\u003ctd\u003eAt least 20 impact points\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cstrong\u003e31337\u003c/strong\u003e\u003c/td\u003e\n\u003ctd\u003e+15%\u003c/td\u003e\n\u003ctd\u003eAt least 30 impact points\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003cp\u003eResearchers become eligible for the loyalty program after \u003cstrong\u003etwo lifetime valid submissions\u003c/strong\u003e.\u003c/p\u003e\n\n\u003ch3\u003eHow Impact Points Work\u003c/h3\u003e\n\n\u003cp\u003eResearchers earn impact points based on the priority of their valid vulnerability reports.\u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eFinding classification\u003c/th\u003e\n\u003cth style=\"text-align: right\"\u003eImpact points\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eP1\u003c/td\u003e\n\u003ctd style=\"text-align: right\"\u003e10\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP2\u003c/td\u003e\n\u003ctd style=\"text-align: right\"\u003e4\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP3\u003c/td\u003e\n\u003ctd style=\"text-align: right\"\u003e1\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP4 or P5\u003c/td\u003e\n\u003ctd style=\"text-align: right\"\u003e0\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eDuplicate or invalid\u003c/td\u003e\n\u003ctd style=\"text-align: right\"\u003e0\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eFalse positive\u003c/td\u003e\n\u003ctd style=\"text-align: right\"\u003e−1\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003cp\u003eLoyalty tiers are calculated using impact points accumulated over the \u003cstrong\u003etrailing 12 months\u003c/strong\u003e.\u003c/p\u003e\n\n\u003ch2\u003e5.3 How Rewards Stack\u003c/h2\u003e\n\n\u003cp\u003eResearchers can earn multiple bonuses on the same valid vulnerability report.\u003c/p\u003e\n\n\u003cp\u003eThe final reward is calculated by applying each eligible multiplier to the base reward:\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eFinal reward = Base reward × Quality multiplier × Campaign multiplier × Loyalty multiplier\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eFor example:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eA high-quality report can receive up to a \u003cstrong\u003e1.15×\u003c/strong\u003e multiplier.\u003c/li\u003e\n\u003cli\u003eIf the finding is part of a priority campaign, an additional multiplier of up to \u003cstrong\u003e1.30×\u003c/strong\u003e can apply.\u003c/li\u003e\n\u003cli\u003eIf the researcher belongs to our 31337 loyalty tier, an additional \u003cstrong\u003e1.15×\u003c/strong\u003e multiplier applies.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eThese multipliers stack multiplicatively.\u003c/p\u003e\n\n\u003ch3\u003eExample 1: Critical Vulnerability with Stacking Bonuses\u003c/h3\u003e\n\n\u003cp\u003eA researcher discovers a critical vulnerability in ChatGPT involving a one-click account takeover. Submits a high quality report and is part of the 31337 loyalty tier, and is working on a priority campaign. \u003c/p\u003e\n\n\u003cp\u003eThe report qualifies for:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eBase reward: \u003cstrong\u003e$20,000\u003c/strong\u003e\n\u003c/li\u003e\n\u003cli\u003eHigh-quality report: \u003cstrong\u003e1.15×\u003c/strong\u003e\n\u003c/li\u003e\n\u003cli\u003ePriority campaign: \u003cstrong\u003e1.30×\u003c/strong\u003e\n\u003c/li\u003e\n\u003cli\u003e31337 loyalty tier: \u003cstrong\u003e1.15×\u003c/strong\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eCalculation:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003e$20,000 × 1.15 × 1.30 × 1.15 = \u003cstrong\u003e$34,385\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eThe researcher receives \u003cstrong\u003e$34,385\u003c/strong\u003e, compared with an illustrative historical reward of $6,000.\u003c/p\u003e\n\n\u003ch3\u003eExample 2: Exceptional Critical Vulnerability\u003c/h3\u003e\n\n\u003cp\u003eA researcher discovers an exceptional critical vulnerability in ChatGPT involving the compromise of all users' chat messages.\u003c/p\u003e\n\n\u003cp\u003eThe researcher is from the 31337 Loyalty Tier, working on a priority campaign target with a great submission, enabling OpenAI to fix the issue quickly. \u003c/p\u003e\n\n\u003cp\u003eThe report qualifies for:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eBase reward: \u003cstrong\u003e$100,000\u003c/strong\u003e\n\u003c/li\u003e\n\u003cli\u003eHigh-quality report: \u003cstrong\u003e1.15×\u003c/strong\u003e\n\u003c/li\u003e\n\u003cli\u003ePriority campaign: \u003cstrong\u003e1.30×\u003c/strong\u003e\n\u003c/li\u003e\n\u003cli\u003e31337 loyalty tier: \u003cstrong\u003e1.15×\u003c/strong\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eCalculation:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003e$100,000 × 1.15 × 1.30 × 1.15 = \u003cstrong\u003e$171,925\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eFinal reward: $171,925\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eThis illustrates how researchers can earn substantial additional rewards by combining report quality, priority campaign participation, and loyalty bonuses.\u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003eAll examples and historical awards are illustrative. Final vulnerability ratings and rewards remain subject to OpenAI's discretion, as described in this policy.\u003c/em\u003e\u003c/p\u003e\n\n\u003cp\u003eOur goal is to build stronger, long-term relationships with security researchers and encourage those who discover impactful vulnerabilities to continue helping keep OpenAI and its users secure.\u003c/p\u003e","industryTagId":"46b8dcc8-bbd9-4a60-80ab-ab088c2bc3e4","targetsOverview":"\u003ch3\u003eAccess to unreleased/private models\u003c/h3\u003e\n\n\u003cp\u003eWe will accept reports of attacks in which you are able to send requests to (and receive output from) an OpenAI model that is private or unreleased (in other words, it is not mentioned in our API documentation nor available in the model picker). These will be eligible for a bounty, with severity determined by the sensitivity of the model in question.\u003c/p\u003e\n\n\u003ch3\u003eCredentials\u003c/h3\u003e\n\n\u003cp\u003eYou may test with your personal account or sign up for an additional testing account using your @bugcrowdninja.com email address. We prefer testing using this email address, but it is not mandatory.\u003c/p\u003e\n\n\u003cp\u003ePlease note that authorized testing does not exempt you from all of OpenAI's terms of service. Abusing the service may result in rate limiting, blocking, or banning. Automated vulnerability scanners may trigger these outcomes. If your account or IP is rate-limited or blocked, please wait for the block to expire; we cannot manually remove it. If your account is banned, contact support@bugcrowd.com to provide an explanation and request un-banning. We will only do this a limited number of times, at our discretion, and never for content violations. You will be removed from the program for repeated ban evasion.\u003c/p\u003e\n\n\u003cp\u003eYou will \u003cem\u003enot\u003c/em\u003e be reimbursed for any upgrades or purchases made on your account.\u003c/p\u003e\n\n\u003ch3\u003eApplication-layer prompt injection mitigations\u003c/h3\u003e\n\n\u003ch2\u003eWe welcome reports of prompt injection so long as they exploit a separate flaw in an in-scope OpenAI product or OpenAI-controlled integration. We are particularly interested in attacks that send sensitive data to an unauthorized recipient with little or no user interaction. Identify the restriction the application should enforce and use test data to show how the attacker bypassed it. If the agent took the action using permissions it already had and no separate product control failed, see the \u003ca href=\"https://bugcrowd.com/engagements/openai-safety\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eSafety Bug Bounty\u003c/a\u003e for eligibility and reporting instructions.\u003c/h2\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cp\u003eThe following are non-exhaustively out-of-scope:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eModel issues. See above.\u003c/li\u003e\n\u003cli\u003eAttacks that may degrade, disrupt, or negatively impact services or user experience (e.g., denial of service, brute force, password spraying, spam, fuzzing, specifically unless authorized by OpenAI's security team).\n\n\u003cul\u003e\n\u003cli\u003eThis includes brute forcing our APIs.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eAttacks that aim to destroy or corrupt data not belonging to you.\u003c/li\u003e\n\u003cli\u003eAttacks stemming from stolen or leaked credentials.\u003c/li\u003e\n\u003cli\u003eDeliberately accessing data belonging to others, including confidential OpenAI data. If testing unexpectedly exposes such data, stop immediately, report how you found it without including its contents, and delete any copies you obtained. Use accounts and data you control to demonstrate impact.\u003c/li\u003e\n\u003cli\u003ePhysical, social engineering, phishing, or electronic attacks against OpenAI personnel, offices, wireless networks, or property.\u003c/li\u003e\n\u003cli\u003eAny attacks on systems not explicitly mentioned as in-scope.\u003c/li\u003e\n\u003cli\u003eAttacks related to email servers, protocols, security (e.g., SPF, DMARC, DKIM), or spam.\u003c/li\u003e\n\u003cli\u003eReports of insecure SSL/TLS ciphers without a working proof-of-concept.\u003c/li\u003e\n\u003cli\u003eReports of missing HTTP headers (e.g., lack of HSTS) without a working proof-of-concept.\u003c/li\u003e\n\u003cli\u003eClickjacking\u003c/li\u003e\n\u003cli\u003eReports of server error messages without proof of an exploit.\u003c/li\u003e\n\u003cli\u003eVulnerabilities impacting only old/end-of-life browsers/plugins.\u003c/li\u003e\n\u003cli\u003eReports relating to server version strings.\u003c/li\u003e\n\u003cli\u003eReports about verification tokens in \u003ccode\u003e./well-known/ai-plugin.json\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttempts to get malicious code executed by posting internal package names (or close replicas of them) in public repos.\u003c/li\u003e\n\u003cli\u003eRunning Python or shell commands within the permissions of ChatGPT’s Code Interpreter sandbox. \u003c/li\u003e\n\u003cli\u003eDiscovery of names or references to unreleased products/features\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eSpecific examples that are out of scope:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eDomains (such as \u003ccode\u003epay.openai.com\u003c/code\u003e) which are CNAME'd to stripe. Please report issues to \u003ca href=\"https://hackerone.com/stripe\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003etheir program\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eDomains that are CNAME'd to other active third party service providers like \u003ccode\u003ecommunity.openai.com\u003c/code\u003e. Unused subdomain takeovers are still in scope.\u003c/li\u003e\n\u003cli\u003eChanging your password may not invalidate all Auth tokens and API Keys.\u003c/li\u003e\n\u003cli\u003eThe ability to add other users to your organization without their permission.\u003c/li\u003e\n\u003cli\u003eAccount deletion does not require password.\u003c/li\u003e\n\u003cli\u003eAPI Keys have broad permissions and capabilities.\u003c/li\u003e\n\u003cli\u003eYou can make more API keys than the cap.\u003c/li\u003e\n\u003cli\u003eCookies can be transferred from one browser to another.\u003c/li\u003e\n\u003cli\u003eChatGPT displaying images from other domains. A report may qualify if loading an image bypasses an application restriction on who may receive sensitive data. Demonstrate the transfer with test data and a destination you control.\u003c/li\u003e\n\u003cli\u003eThe expected functionality of OpenGraph Tags (which request information from a rendered url in order to show a preview).\u003c/li\u003e\n\u003cli\u003eWeird model behavior following \"special\" or \"bugged\" tokens.\u003c/li\u003e\n\u003cli\u003eCertain overlong inputs can cause ChatGPT to produce what appear to be random or other people's answers.\n\n\u003cul\u003e\n\u003cli\u003eThese are a specific form of model hallucination caused by a bug in ChatGPT which causes the model to be asked for a completion with a missing query.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eReports that you can create accounts using online SMS services, without a detailed and specific description of a different security issue.\u003c/li\u003e\n\u003cli\u003eMethods to bypass IP blocks or geoblock by changing your IP or using a VPN.\u003c/li\u003e\n\u003cli\u003eMethods to bypass cloudflare on api.openai.com.\u003c/li\u003e\n\u003cli\u003eMethods to bypass the \u003ccode\u003eChatGPT is at capacity\u003c/code\u003e page.\u003c/li\u003e\n\u003cli\u003eMethods to emulate a browser to bypass captchas.\u003c/li\u003e\n\u003cli\u003eWebsites which are not owned and operated by OpenAI, including \u003ccode\u003eai.com\u003c/code\u003e and \u003ccode\u003eopen.ai\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003ePhishing websites, proxies for ChatGPT, discord bots, and other \"free\" websites which provide access the product.\u003c/li\u003e\n\u003cli\u003eChanges to ChatGPT’s behavior caused solely by a third-party browser extension. \u003c/li\u003e\n\u003cli\u003eThe fact that you can share model presets by link on \u003ccode\u003eplatform.openai.com/playground\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eIssues related to changing the email address sent to intercom.\u003c/li\u003e\n\u003cli\u003eIssues related to billing lagging behind requests.\u003c/li\u003e\n\u003cli\u003eMost issues relating to API rate limiting or API quota enforcement unless the bug allows complete bypass. \n\n\u003cul\u003e\n\u003cli\u003eWe reward submissions that demonstrate a meaningful bypass of OpenAI rate limits or platform controls that enables sustained usage at significant scale beyond intended limits. Issues that don't scale to the order of hundreds of requests beyond enforced rate limits (e.g., one-off or low-volume bypasses) are considered out of scope for financial reward.\u003c/li\u003e\n\u003cli\u003eOut of scope: temporarily exceeding the API requests-per-minute limit, the tokens-per-minute limit, or the hard spending cap.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eThe fact that you can send shell commands to the Code Interpreter VM instance.\u003c/li\u003e\n\u003cli\u003eVulnerabilities in most of our dormant open source projects. \n\n\u003cul\u003e\n\u003cli\u003eWe welcome reports (and patches) but typically will only reward for security issues with demonstrated impact in our actively maintained projects.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003e* Issues that require excessive user cooperation or unlikely social engineering, such as pasting code into browser developer tools, disabling browser protections, or sending information to the attacker out of band. Visiting an attacker-controlled page can qualify when the page bypasses a control covered by the in-app browser or official-extension rules.\u003c/h2\u003e\n\n\u003ch2\u003eCVE Assignment\u003c/h2\u003e\n\n\u003cp\u003eOpenAI's CVE Assignment Policy explains how we handle vulnerability reports as a CVE Numbering Authority (CNA). This policy describes which types of security issues are in scope, how to submit reports, how CVE identifiers are assigned, and how we coordinate public disclosure. \u003ca href=\"https://openai.com/policies/openai-cve-assignment-policy/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eLearn more\u003c/a\u003e.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003eOpenAI will not threaten or bring any legal action against anyone who makes a good faith effort to comply with this bug bounty policy. This includes any claim under the DMCA for circumventing technological measures to protect the services and applications eligible under this policy.\u003c/p\u003e\n\n\u003cp\u003eAs long as you comply with this policy:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eWe consider your security research to be \"authorized\" under the Computer Fraud and Abuse Act (and/or similar state laws), and\u003c/li\u003e\n\u003cli\u003eWe waive any restrictions in our applicable Terms of Use and Usage Policies that would prohibit your participation in this policy, but only for the limited purpose of your security research under this policy.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eOpenAI systems and services may be interconnected with third-party systems and services. If you submit a report through our bug bounty program that affects a third party service, we will limit what we share with the affected third party. Please understand that, while we can authorize your research on OpenAI’s systems and services, we cannot authorize your efforts on third-party products or guarantee they won’t pursue legal action against you. That said, if legal action is initiated by a third party against you because of your participation in this bug bounty program, and you have complied with our bug bounty policy, we will take steps to make it known that your actions were conducted in compliance with this policy. This is not, and should not be understood as, any agreement on our part to defend, indemnify, or otherwise protect you from any third party action based on your actions.\u003c/p\u003e\n\n\u003cp\u003eYou are expected, as always, to comply with all applicable laws.\u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003eIf you have concerns or are unsure whether your security research aligns with this policy, please contact support@bugcrowd.com before proceeding.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"partial","label":"Partial safe harbor","description":"This engagement provides a limited goodwill statement about not pursuing legal action related to security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"831be957-0b35-4096-91a2-636ad502702e","name":"ChatGPT Services","targets":[{"id":"fb20df1f-3c20-4bc4-bcf6-054fc9ac5061","uri":"https://chatgpt.com","name":"ChatGPT Web","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"07022e49-7336-4337-a2ac-111fb6946452","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"c9f60107-e82c-48f3-aeb3-c2059a394a01","uri":"https://chat.openai.com","name":"ChatGPT Plugins","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"36f1dbbc-c503-4f08-a9b5-bc42f0547f46","sortOrder":7},"sortOrder":7,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"c9f60107-e82c-48f3-aeb3-c2059a394a01"},{"id":"ef82adfb-fd5b-439b-a090-ed44823bf259","name":"Azure","targetId":"c9f60107-e82c-48f3-aeb3-c2059a394a01"},{"id":"f21f7de7-31b4-4cc8-89a4-39c9eb6b7345","name":"Python","targetId":"c9f60107-e82c-48f3-aeb3-c2059a394a01"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"b618d4ec-70cf-4dce-adf6-e958a61bd134","p1MaxCents":3000000,"p1MinCents":1000000,"p2MaxCents":700000,"p2MinCents":300000,"p3MaxCents":300000,"p3MinCents":150000,"p4MaxCents":null,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":10000000},"descriptionHtml":"\u003cp\u003eThe ChatGPT service is a mosaic of evolving applications. Examples of in-scope targets include\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eChatGPT Web\u003c/li\u003e\n\u003cli\u003eDots\u003c/li\u003e\n\u003cli\u003eSites\u003c/li\u003e\n\u003cli\u003eSpaces\u003c/li\u003e\n\u003cli\u003eImages\u003c/li\u003e\n\u003cli\u003eHealth\u003c/li\u003e\n\u003cli\u003eFinances\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eThese services have many security related surfaces, such as\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003elogins\u003c/li\u003e\n\u003cli\u003esubscriptions\u003c/li\u003e\n\u003cli\u003eOpenAI-created plugins (e.g. Browsing, Code Interpreter)\u003c/li\u003e\n\u003cli\u003eplugins you create yourself \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cblockquote\u003e\n\u003cp\u003e\u003cstrong\u003eNote\u003c/strong\u003e: You are not authorized to conduct security testing on plugins created by other people.**\u003c/p\u003e\n\u003c/blockquote\u003e\n\n\u003cp\u003eIf you have a conversation with ChatGPT to demonstrate your issue, please include the conversation ID, which can be found in the URL that appears in your address bar when the conversation is open.\u003c/p\u003e\n\n\u003ch3\u003eExamples of things we are interested in\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eStored or Reflected XSS\u003c/li\u003e\n\u003cli\u003eCSRF\u003c/li\u003e\n\u003cli\u003eSQLi\u003c/li\u003e\n\u003cli\u003eAuthentication Issues\u003c/li\u003e\n\u003cli\u003eAuthorization Issues\u003c/li\u003e\n\u003cli\u003eData Exposure\u003c/li\u003e\n\u003cli\u003ePayments issues\u003c/li\u003e\n\u003cli\u003eMethods to bypass Cloudflare protection by sending traffic to endpoints that are not protected by cloudflare\u003c/li\u003e\n\u003cli\u003eAbility to run queries on pre-release or private models\u003c/li\u003e\n\u003cli\u003eOpenAI created plugins:\n\n\u003cul\u003e\n\u003cli\u003eBrowsing\u003c/li\u003e\n\u003cli\u003eCode Interpreter\u003c/li\u003e\n\u003c/ul\u003e\u003c/li\u003e\n\u003cli\u003eSecurity issues with the plugin creation system:\n\n\u003cul\u003e\n\u003cli\u003eOutputs which cause the browser application to crash\u003c/li\u003e\n\u003cli\u003eCredential security\u003c/li\u003e\n\u003cli\u003eOAuth\u003c/li\u003e\n\u003cli\u003eSSRF\u003c/li\u003e\n\u003cli\u003eMethods to cause the plugin service to make calls to unrelated domains from where the manifest was loaded\u003c/li\u003e\n\u003c/ul\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eModel Related Issues\u003c/h3\u003e\n\n\u003cp\u003eFor model related issues, please use the reporting channels discussed earlier.  \u003cstrong\u003eModel issues are strictly out of scope for the Security program and will not be rewarded.\u003c/strong\u003e\u003c/p\u003e\n\n\u003ch3\u003eHosted code execution\u003c/h3\u003e\n\n\u003cp\u003eCode Interpreter and Agent Mode run code inside OpenAI-hosted sandboxes. Running Python or shell commands within the session’s permissions is expected. In GPT-5 sessions that use the \u003ccode\u003econtainer\u003c/code\u003e tool, shell commands can run as \u003ccode\u003eroot\u003c/code\u003e inside the gVisor sandbox. Reports that show only these expected capabilities are out of scope.\u003c/p\u003e\n\n\u003cp\u003eTo report a sandbox bypass, identify the tool and the restriction that applied in the supported configuration you tested. Use data you control to show what your code did beyond that restriction. Examples include: \u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eReading another account’s file.\u003c/strong\u003e In a private Code Interpreter session in test account A, create \u003ccode\u003eproof.txt\u003c/code\u003e with a random value. From a separate test account B that you control, show a Python file read that returns that value. Include both session IDs. Keep the file and its value out of account B’s prompts and attachments.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eChanging a read-only file.\u003c/strong\u003e If the product gives the sandbox read-only access to a file you control, show the write that the sandbox normally denies. Use the bypass to change the file. Read it back from its original location outside the sandbox to confirm that the original changed.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eReaching a blocked network destination.\u003c/strong\u003e Show that the active sandbox policy denies a request to a server you control. Then use the bypass to send a request from code in the same sandbox to a unique path on that server, such as \u003ccode\u003e/bounty-test-\u0026lt;random-value\u0026gt;\u003c/code\u003e. Include the tool call and the matching entry from your server’s access log.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRunning a command on the host.\u003c/strong\u003e If the bypass lets you launch a host process, run a harmless command such as \u003ccode\u003e/bin/echo bounty-test-\u0026lt;random-value\u0026gt;\u003c/code\u003e. Show what identifies the process as running on the host, such as a host-side process record containing that value. Include the session ID and timestamp so we can trace the command.\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{"1":{"min":10000,"max":30000},"2":{"min":3000,"max":7000},"3":{"min":1500,"max":3000},"4":{"min":null,"max":null},"5":{"min":null,"max":null},"programMax":100000},"recentChangeFlags":null},{"id":"2ba1f152-693c-4874-a1db-806cf9e66610","name":"API Targets","targets":[{"id":"0fda723f-ec1e-47a5-bd5a-37df666b2766","uri":"https://api.openai.com","name":"api.openai.com","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"672eb029-eaa5-471e-b2f2-96012cb43331","sortOrder":0},"sortOrder":0,"tags":[{"id":"ef82adfb-fd5b-439b-a090-ed44823bf259","name":"Azure","targetId":"0fda723f-ec1e-47a5-bd5a-37df666b2766"},{"id":"f21f7de7-31b4-4cc8-89a4-39c9eb6b7345","name":"Python","targetId":"0fda723f-ec1e-47a5-bd5a-37df666b2766"}],"recentChangeFlags":null},{"id":"4547f931-ae0e-431a-b1fc-82d979b5c39e","uri":"https://platform.openai.com/playground","name":"Developer Platform Playground","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e3d45989-d6a0-4fd8-9641-1cc3aa3210d5","sortOrder":1},"sortOrder":1,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4547f931-ae0e-431a-b1fc-82d979b5c39e"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"b618d4ec-70cf-4dce-adf6-e958a61bd134","p1MaxCents":3000000,"p1MinCents":1000000,"p2MaxCents":700000,"p2MinCents":300000,"p3MaxCents":300000,"p3MinCents":150000,"p4MaxCents":null,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":10000000},"descriptionHtml":"\u003cp\u003eThe following services and applications are in-scope:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eThe OpenAI APIs\u003c/li\u003e\n\u003cli\u003ePublic cloud resources or infrastructure involved in serving the OpenAI API, including:\n\n\u003cul\u003e\n\u003cli\u003ecloud storage accounts (e.g., Azure data blobs).\u003c/li\u003e\n\u003cli\u003ecloud compute servers (e.g., Azure virtual machines).\u003c/li\u003e\n\u003c/ul\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eAs noted earlier, model safety and content issues are \u003cstrong\u003enot\u003c/strong\u003e eligible for reward in any of the categories.\u003c/p\u003e","rewardRangeData":{"1":{"min":10000,"max":30000},"2":{"min":3000,"max":7000},"3":{"min":1500,"max":3000},"4":{"min":null,"max":null},"5":{"min":null,"max":null},"programMax":100000},"recentChangeFlags":null},{"id":"2911713b-d052-4154-a30b-fe7fd09fe33a","name":"ChatGPT Desktop \u0026 Codex CLI","targets":[{"id":"bb382f87-b985-44ce-9662-9e0baa640bc2","uri":null,"name":"ChatGPT Desktop","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a5be9e5f-b6d6-4d48-8b10-3ea2abb9de00","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"2247857a-fd92-4e75-8014-b5d381b2d1f9","uri":"","name":"Codex CLI","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"2d6624de-4de7-47b3-8a70-867ad649e9e1","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":2,"description":null,"rewardRange":{"id":"b618d4ec-70cf-4dce-adf6-e958a61bd134","p1MaxCents":3000000,"p1MinCents":1000000,"p2MaxCents":700000,"p2MinCents":300000,"p3MaxCents":300000,"p3MinCents":150000,"p4MaxCents":null,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":10000000},"descriptionHtml":"\u003cp\u003eThis group covers \u003ca href=\"https://chatgpt.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eChatGPT Desktop\u003c/a\u003e, its \u003ca href=\"https://help.openai.com/en/articles/20001277-using-the-built-in-browser-in-the-chatgpt-desktop-app\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ein-app browser\u003c/a\u003e, Codex CLI, and the official ChatGPT browser extension for \u003ca href=\"https://chromewebstore.google.com/detail/chatgpt/hehggadaopoacecdllhhajmbjkdcmajg\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eChrome\u003c/a\u003e \u0026amp; \u003ca href=\"https://microsoftedge.microsoft.com/addons/detail/ChatGPT/odlomjlbamekndcpllcnffbgeohgkmjh\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eEdge\u003c/a\u003e. It also covers OpenAI-controlled software that connects these components, controls the browser, or enforces their security restrictions.\u003c/p\u003e\n\n\u003cp\u003eValid reports must show which security control a less-privileged attacker bypassed and what that allowed the attacker to do. For example, if a web page escapes the in-app browser’s renderer sandbox and starts a shell on the user’s device, report the browser escape. The browser was responsible for containing the page.\u003c/p\u003e\n\n\u003cp\u003eChatGPT desktop and Codex CLI employ multiple sandboxing mechanisms. The sections below define the intended security properties and limitations of each sandbox technology.\u003c/p\u003e\n\n\u003ch2\u003eSandbox for commands the model runs\u003c/h2\u003e\n\n\u003cp\u003eThis sandbox covers commands the model issues through the normal sandboxed command tool in ChatGPT Desktop or Codex CLI. A report must demonstrate one of the filesystem, network, process, or operating-system violations described below. A file read alone by a model-issued command is out of scope, including a read outside the workspace. An attack that depends on the desktop client or CLI processing attacker-controlled files on the user’s filesystem is out of scope, as described below.\u003c/p\u003e\n\n\u003ch3\u003eIn scope — the model’s command bypasses a sandbox restriction\u003c/h3\u003e\n\n\u003cp\u003eIdentify the command, the restriction that applied in the supported configuration you tested, and the operation that succeeded.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eFilesystem writes.\u003c/strong\u003e The command writes outside an authorized directory or modifies a file the active policy protects from changes, such as repository metadata or a file that stores credentials, approvals, or application state. \u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eNetwork.\u003c/strong\u003e The command makes an outbound connection to a destination the active policy blocks for that command.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eProcess or operating system.\u003c/strong\u003e The command starts a prohibited process, gains a more privileged OS identity, accesses a protected system resource, or escapes an enforced process, account, or OS boundary.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eA command can create files to demonstrate a bypass. For example, the model creates a script in its writable workspace and runs it through the sandboxed command tool. If the script writes to a second directory that the active policy makes read-only, the report is in scope.\u003c/p\u003e\n\n\u003ch3\u003eOut of scope — attacker-controlled files, project startup, and client internals\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eAttacker-controlled files on the user’s device.\u003c/strong\u003e The attack depends on the desktop client, CLI, or command tool processing a repository or other file supplied by the attacker. This includes a repository the user clones or asks the app to fetch or merely inspect. Examples include malicious \u003ccode\u003e.git\u003c/code\u003e contents and projects with crafted file layouts or permissions.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eProject trust and client behavior.\u003c/strong\u003e Bypassing the “Trust this project” prompt is out of scope. Other excluded paths include the client starting a repository-defined MCP server when a project opens or a CLI session starts, an updater running a repository-supplied hook, and an attacker calling client internals directly to launch a program.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eHelpers the client runs before sandboxing.\u003c/strong\u003e An attack is out of scope if it requires the client to run an attacker-controlled launcher or helper before applying the sandbox, even if a sandboxed command created that file. In the script example above, this excludes both a helper that writes to the protected directory itself and one that weakens the restriction so the next command writes there.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eIn-app browser and official extension\u003c/h2\u003e\n\n\u003cp\u003eSelect the \u003cstrong\u003eChatGPT Desktop\u003c/strong\u003e target for reports about the in-app browser or official extension.\u003c/p\u003e\n\n\u003ch3\u003eIn scope — a browser or extension security control fails\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eSandbox escape.\u003c/strong\u003e Content escapes an enforced renderer, browser, extension, application, or OS boundary. For example, previewing a downloaded document in the in-app browser lets the document escape the renderer sandbox.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCommands from unauthorized callers.\u003c/strong\u003e A website, another extension, or a local program can issue a command reserved for the browser, official extension, or desktop app. Show what the caller can read, change, or execute beyond its existing permissions. For example, an unrelated website impersonates the ChatGPT side panel and receives private text selected in another tab.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAccess across sites, accounts, profiles, or sessions.\u003c/strong\u003e A flaw in an OpenAI browser component lets one site read or change another site’s private data, or lets a request authorized for one account, browser profile, or session access another that the product keeps separate. For example, a website embeds a signed-in page from another origin. A flaw in the extension gives the embedding website’s own JavaScript private text that the embedded site never shared with it.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eSensitive data disclosure.\u003c/strong\u003e A flaw in the browser, extension, or desktop app exposes credentials, session data, private page content, browsing history, screenshots, or local files despite an access or transfer restriction. For example, the user denies an upload to a site, but the browser’s file picker still gives that site the file. Misdirected uploads caused by prompt injection are out of scope when the agent uses existing permissions or a valid approval, even if the file contains sensitive data.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eFile transfers and network access.\u003c/strong\u003e Web content reads, uploads, downloads, or modifies local data beyond its permissions, bypasses a transfer’s source or destination restriction, or reaches a blocked local service or network destination. One example is a transfer that follows a redirect and delivers data to a denied origin.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eOut of scope — browser behavior within its permissions\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePermitted access and traffic.\u003c/strong\u003e Examples include valid cross-origin requests, access through an authorized connected profile, and intentionally shared browser state. An extension may use its declared browser permission for an operation the caller is authorized to request and share the result only with an authorized recipient. The browser uses its own network permissions. To report a network bypass in the sandbox for model-run commands, show a command issued through the sandboxed tool reaching a destination its policy blocks.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eA download that only delivers the file.\u003c/strong\u003e The browser downloads a repository archive. The attack succeeds only after the archive is extracted and Codex processes its malicious \u003ccode\u003e.git\u003c/code\u003e contents or runs a repository-supplied hook. The exclusion for attacker-controlled files applies.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eThe extension blocks a request.\u003c/strong\u003e A website sends a message to the extension. The extension rejects it before releasing private data or taking action for the website.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eChatGPT reads an authorized tab.\u003c/strong\u003e A user allows ChatGPT to read a tab that contains content embedded from another site. The snapshot returned to the user’s chat can include text displayed by that embedded site.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eChatGPT uses an existing sign-in.\u003c/strong\u003e A user authorizes ChatGPT to perform a task on a site using a connected browser profile. If that profile is already signed in to the site, ChatGPT can use that session for the authorized task.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eUpstream Chromium and Google Chrome — out of scope with one exception\u003c/h3\u003e\n\n\u003cp\u003eVulnerabilities in upstream Chromium or Google Chrome that reproduce in an equivalent, unmodified upstream release are out of scope and should be reported to \u003ca href=\"https://bughunters.google.com/about/rules/chrome-friends/chrome-vulnerability-reward-program-rules\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eGoogle’s Chrome Vulnerability Reward Program\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003eThis exception applies only to Chromium bundled with the ChatGPT desktop app (formerly the Codex app). A previously disclosed Chromium vulnerability may be eligible only if all three conditions are met.\u003c/p\u003e\n\n\u003col\u003e\n\u003cli\u003eMore than seven calendar days have elapsed since Google published the corresponding Chrome Stable security fix.\u003c/li\u003e\n\u003cli\u003eOpenAI has yet to publish a supported production release of the desktop app that fixes or effectively mitigates the vulnerability for the affected operating system and architecture.\u003c/li\u003e\n\u003cli\u003eThe report demonstrates a concrete High- or Critical-severity violation of an in-scope security boundary in the latest publicly available supported release of the desktop app.\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003cp\u003eReproduce the issue against the desktop app. A version number, CVE identifier, scanner result, or upstream proof of concept alone is insufficient. Independently installed browsers used with an official OpenAI browser extension fall outside this exception. Flaws introduced by OpenAI code, browser configuration, official extensions, or OpenAI-controlled product integrations remain in scope.\u003c/p\u003e\n\n\u003ch2\u003eIn scope — approvals, credentials, and access controls\u003c/h2\u003e\n\n\u003cp\u003eAttacker-controlled content, including prompt injection, can trigger a flaw in one of these controls. The exclusions above also apply here. For example, an attack that requires Codex to load a malicious project file is out of scope even if the result is credential disclosure or an unauthorized action.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eBypassing a required approval.\u003c/strong\u003e Identify the built-in product rule, active user setting, or enforced administrator policy that requires approval before the specific action. Show which approval mode and prior grants applied, then demonstrate that the product completed the action without valid approval. Examples include:\n\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eCodex CLI.\u003c/strong\u003e With the user configured as reviewer and an active \u003ccode\u003eprompt\u003c/code\u003e rule for running \u003ccode\u003egh pr view\u003c/code\u003e outside the sandbox, the model runs that command outside the sandbox before the user approves it.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eIn-app browser.\u003c/strong\u003e With approval required for new sites, automatic browser review off, and no grant for your test host, ChatGPT reads private content from your signed-in test page through the browser before you approve access to that host.\u003c/li\u003e\n\u003c/ul\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInvalid or misapplied approval.\u003c/strong\u003e The product accepts a forged, expired, or revoked approval, accepts a one-time approval twice, or honors a valid approval for the wrong actor, action, site, recipient, or context.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAuthentication secrets sent to the wrong recipient.\u003c/strong\u003e A flaw that causes an OpenAI client to send an API key, OAuth access or refresh token, session cookie, or other authentication secret to a destination outside those permitted for that secret. For example, a signed-in user opens an attacker-controlled website in the in-app browser. A flaw in ChatGPT Desktop adds the user’s ChatGPT access token to the request’s Authorization header, exposing it to the website operator.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUnauthorized access or action.\u003c/strong\u003e An attacker uses untrusted content or a restricted component to bypass an enforced sandbox, browser, origin, account, profile, session, destination, or other authorization rule. The bypass lets the attacker execute code, obtain protected data, or perform an action beyond their authority.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAdministrator restrictions and disabled capabilities.\u003c/strong\u003e An attacker bypasses an enforced administrator restriction or uses a capability the user or administrator disabled. For example, an administrator limits plugin marketplace sources to approved Git hosts. If Codex fetches a harmless marketplace repository from a host outside that list, the fetch itself demonstrates the bypass.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eOut of scope across this group\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePermitted actions and expected prompts.\u003c/strong\u003e Actions and data access allowed by the active configuration are out of scope on their own. This includes actions covered by a valid saved grant or approved by an automatic reviewer authorized for that action. A missing dialog, the sensitivity of an action, or a request in chat such as “ask me before sending” is insufficient on its own to establish an approval bypass.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eModel behavior alone.\u003c/strong\u003e Prompt injection, jailbreaks, hallucinations, misleading output, or misuse of existing access or valid, applicable approvals are out of scope unless the report also demonstrates a bypass of a security control in an in-scope OpenAI product or OpenAI-controlled integration. This exclusion applies even if the agent discloses sensitive data or performs an unwanted action. These reports may qualify under the separate Safety program.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eSocial engineering alone.\u003c/strong\u003e Examples include phishing, persuading someone to enter credentials, or convincing a user to approve an accurately described action without a separate implementation flaw.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eExisting device access alone.\u003c/strong\u003e This includes user-installed malware, a compromised device, root or administrator access, or unrestricted code already running with the user’s authority. A report starting with that access must show which separate product or privilege boundary the attacker crossed.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eThird-party issues.\u003c/strong\u003e A flaw confined to a third-party browser, website, extension, tool, or dependency is out of scope without an independent OpenAI-specific defect. The limited exception for bundled Chromium appears in the browser section above.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePerformance, hardening, and disruptive testing.\u003c/strong\u003e Performance issues, speculative hardening suggestions, and other non-security bugs are out of scope. So are denial-of-service or resource-exhaustion attacks that require sustained, disruptive, or large-scale traffic.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eSupported configurations\u003c/h2\u003e\n\n\u003cp\u003eReproduce the issue on a current, supported release in a documented, supported configuration. Test features available through a supported release, an authorized rollout, or a testing path OpenAI expressly identifies. Reports that reproduce only on unsupported or obsolete product versions are out of scope. A documented, supported optional feature is eligible when the report demonstrates a bypass of a restriction that applies with that feature enabled. Features listed in the Codex CLI \u003ccode\u003e/experimental\u003c/code\u003e menu are ineligible for rewards whether enabled through that menu or in \u003ccode\u003econfig.toml\u003c/code\u003e.\u003c/p\u003e\n\n\u003cp\u003eIf you choose unrestricted execution, disable a protection, or grant a capability, identify a restriction that still applies and show how the attack bypasses it. This includes restrictions enforced by an administrator.\u003c/p\u003e\n\n\u003ch2\u003eUI-only findings — P5 unless the impact is P1\u003c/h2\u003e\n\n\u003cp\u003eVisual impersonation, misleading origin displays, and similar UI-only findings in the in-app browser or OpenAI’s first-party desktop and extension interfaces are P5 (Informational) unless they demonstrate P1 (Critical) impact. The P1 assessment depends on the impact you demonstrate, such as direct exposure of sensitive data, remote code execution, or an action beyond the user’s authority.\u003c/p\u003e\n\n\u003cp\u003eYou may submit P5 findings. They carry no monetary reward or commitment to a response or remediation timeline.\u003c/p\u003e\n\n\u003ch2\u003eSafe testing and reporting\u003c/h2\u003e\n\n\u003cp\u003eUse only accounts, devices, browser profiles, websites, extensions, and data you own or are authorized to test. You may use your own sites and ordinary supported workflows. Stop once you demonstrate the issue. Do not access another person’s data, make real purchases, take destructive actions, disrupt services, or attack OpenAI personnel or unrelated third parties.\u003c/p\u003e\n\n\u003cp\u003eInclude the product and version, OS, active configuration, relevant permissions and approvals, and reproduction steps. Identify the attacker’s starting access, the restriction that applied, the protected resource or action, and the unauthorized result. For model-assisted exploits, name the control that failed in the product, bundled browser, or OpenAI-controlled integration.\u003c/p\u003e","rewardRangeData":{"1":{"min":10000,"max":30000},"2":{"min":3000,"max":7000},"3":{"min":1500,"max":3000},"4":{"min":null,"max":null},"5":{"min":null,"max":null},"programMax":100000},"recentChangeFlags":null},{"id":"f4c43402-4eed-4278-ad55-2a56b55cfebb","name":"Other OpenAI Targets","targets":[{"id":"fcb4d4b4-62c6-430b-96e3-37bde84f5456","uri":"https://openai.com/","name":"openai.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1b6b451b-a319-4e0a-a8c7-ec4762993407","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"fcb4d4b4-62c6-430b-96e3-37bde84f5456"},{"id":"ef82adfb-fd5b-439b-a090-ed44823bf259","name":"Azure","targetId":"fcb4d4b4-62c6-430b-96e3-37bde84f5456"},{"id":"f21f7de7-31b4-4cc8-89a4-39c9eb6b7345","name":"Python","targetId":"fcb4d4b4-62c6-430b-96e3-37bde84f5456"}],"recentChangeFlags":null},{"id":"d9475453-cdfe-4804-badc-0562ad8d7f00","uri":"https://*.openai.org","name":"OpenAi Research","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3a64a1b0-7a71-4fc6-a32a-c0acb4f53113","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"75fe2658-39e9-4aeb-9add-5a26c0c8ac4d","uri":null,"name":"*.openai.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"983af1d6-54fc-4bd2-a616-521ae4599755","sortOrder":2},"sortOrder":2,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"75fe2658-39e9-4aeb-9add-5a26c0c8ac4d"},{"id":"ef82adfb-fd5b-439b-a090-ed44823bf259","name":"Azure","targetId":"75fe2658-39e9-4aeb-9add-5a26c0c8ac4d"},{"id":"f21f7de7-31b4-4cc8-89a4-39c9eb6b7345","name":"Python","targetId":"75fe2658-39e9-4aeb-9add-5a26c0c8ac4d"}],"recentChangeFlags":null},{"id":"76d3a23b-b7f1-49bc-980f-86d0b14516ef","uri":"","name":"Other","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f16fc717-6117-4bf7-8538-995dcdce4548","sortOrder":3},"sortOrder":3,"tags":[{"id":"d14cf1dd-8069-48ef-9a2b-779bf3a066f9","name":"Artificial Intelligence","targetId":"76d3a23b-b7f1-49bc-980f-86d0b14516ef"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":4,"description":null,"rewardRange":{"id":"d4d17e51-d929-4e98-9342-2d34aba2700b","p1MaxCents":700000,"p1MinCents":300000,"p2MaxCents":300000,"p2MinCents":200000,"p3MaxCents":200000,"p3MinCents":100000,"p4MaxCents":null,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":2500000},"descriptionHtml":"\u003cp\u003eThis target group includes:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eThe OpenAI.com website.\u003c/li\u003e\n\u003cli\u003eThe OpenAI Developer Documentation.\u003c/li\u003e\n\u003cli\u003eOpenAI Research Org Targets\u003c/li\u003e\n\u003cli\u003eAny other Internet-facing infrastructure operated by OpenAI and not specified in another target.\u003c/li\u003e\n\u003cli\u003eAny other public cloud resources or infrastructure operated by OpenAI.\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{"1":{"min":3000,"max":7000},"2":{"min":2000,"max":3000},"3":{"min":1000,"max":2000},"4":{"min":null,"max":null},"5":{"min":null,"max":null},"programMax":25000},"recentChangeFlags":null},{"id":"4422957f-6f6b-48cd-a0ca-0b02c9bf046c","name":"Third Party Corporate Targets","targets":[{"id":"fa4bd439-8067-406e-bebf-638551ce1632","uri":"","name":"Third Party Targets","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a5770d58-afc0-41e6-89f6-ee7f7638f969","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":5,"description":null,"rewardRange":{"id":"28fb7c41-5972-4568-a7f7-0d5499c710af","p1MaxCents":500000,"p1MinCents":200000,"p2MaxCents":200000,"p2MinCents":100000,"p3MaxCents":null,"p3MinCents":null,"p4MaxCents":null,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":1000000},"descriptionHtml":"\u003cp\u003eThis target group consists of confidential OpenAI corporate information that may be exposed through third parties. Some examples of the types vendors which would qualify in this category include:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eGoogle Workspace\u003c/li\u003e\n\u003cli\u003eAsana, Trello, Jira, Monday.com\u003c/li\u003e\n\u003cli\u003eNotion, Confluence, Evernote\u003c/li\u003e\n\u003cli\u003eIntercom, Hubspot, Zendesk\u003c/li\u003e\n\u003cli\u003eStripe, Airbase, Navan\u003c/li\u003e\n\u003cli\u003eMode, Charthop, Looker\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eYou may report confidential OpenAI information exposed in a public source or a source you are already authorized to view. \u003cstrong\u003eYou are not authorized to perform additional security testing against these companies.\u003c/strong\u003e  Follow applicable law and the provider\u0026#39;s terms of service. Do not test the provider\u0026#39;s systems. The providers listed above are examples and may have no business relationship with OpenAI.\u003c/p\u003e\n\n\u003cp\u003eStop as soon as the exposure is visible. Report where and how you found it without including confidential contents. Do not open additional documents, download files, or search for more records to establish the extent of the exposure.\u003c/p\u003e\n\n\u003cp\u003eIndividual document exposures are typically rated P4 or P5 and receive no monetary reward at those priorities. Particularly sensitive information may warrant a higher rating in rare cases. If the evidence already visible shows that one flaw exposed multiple documents, we may take that into account when setting the reward.\u003c/p\u003e","rewardRangeData":{"1":{"min":2000,"max":5000},"2":{"min":1000,"max":2000},"3":{"min":null,"max":null},"4":{"min":null,"max":null},"5":{"min":null,"max":null},"programMax":10000},"recentChangeFlags":null},{"id":"238c4f73-4fbe-4f1b-93f3-1e4167c11c51","name":"OpenAI API Keys","targets":[{"id":"9028bfcd-caaa-44a7-a3ce-53d9cb2c89d7","uri":"","name":"OpenAI API Keys","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8ed9d76f-d477-4578-8ba5-593e2afb5c6e","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":6,"description":null,"rewardRange":{"id":"c02182db-904d-42ac-9061-f9b697e01937","p1MaxCents":250000,"p1MinCents":25000,"p2MaxCents":null,"p2MinCents":null,"p3MaxCents":null,"p3MinCents":null,"p4MaxCents":null,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eAPI Key Security Initiative for OpenAI\u003c/p\u003e\n\n\u003cp\u003eOur customers occasionally post their API keys on the internet. We need your help to keep them safe. Once a month, we award one bonus through Bugcrowd to the researcher with the most impactful eligible submission of publicly exposed customer API keys. We consider only the first report of each key. The displayed P1 range does not apply to individual key reports. We contact the recipient directly. Please do not ask Bugcrowd Support for status updates.\u003c/p\u003e\n\n\u003col\u003e\n\u003cli\u003eSubmit exposed keys only through the \u003ca href=\"https://forms.gle/h8bQ5YKWzXb8FtrQ8\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eOpenAI API Key Bug Bounty Submission Form\u003c/a\u003e. Do not use a key to test whether it works. Submitting a key through Bugcrowd results in an out-of-scope report and a point deduction.\u003c/li\u003e\n\u003cli\u003eDo not post or share OpenAI API keys online.\u003c/li\u003e\n\u003cli\u003eValid OpenAI API Keys have the prefix \u003ccode\u003esk-\u003c/code\u003e or \u003ccode\u003esess-\u003c/code\u003e Any submission that does not adhere to this format will be rejected.\u003c/li\u003e\n\u003cli\u003eAdditional Things to Avoid:\n\n\u003cul\u003e\n\u003cli\u003ePlease don\u0026#39;t submit the same keys repeatedly.\u003c/li\u003e\n\u003cli\u003eDon\u0026#39;t create keys just to submit them.\u003c/li\u003e\n\u003cli\u003eDon\u0026#39;t submit keys one-by-one - we can handle them in bulk.\u003c/li\u003e\n\u003c/ul\u003e\u003c/li\u003e\n\u003cli\u003eCreating multiple accounts or generating many API keys for a single account is a violation of our terms. This may result in account suspension.\nPlay nicely. We keep a close eye on everything. Make sure that you act responsibly.\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003cp\u003eThank you for your assistance!\u003c/p\u003e\n\n\u003cp\u003eThis form is temporary - we will create an API for this soon.\u003c/p\u003e\n\n\u003cp\u003eSubmit all findings here:\u003cbr\u003e\n\u003ca href=\"https://forms.gle/h8bQ5YKWzXb8FtrQ8\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eOpenAI API Key Bug Bounty Submission\u003c/a\u003e\u003c/p\u003e\n\n\u003cblockquote\u003e\n\u003ch2\u003eIMPORTANT\u003c/h2\u003e\n\n\u003cp\u003eDo not submit API keys to bugcrowd. The submission will be marked as out of scope and you will lose points. You must submit through the form.\u003c/p\u003e\n\u003c/blockquote\u003e","rewardRangeData":{"1":{"min":250,"max":2500},"2":{"min":null,"max":null},"3":{"min":null,"max":null},"4":{"min":null,"max":null},"5":{"min":null,"max":null}},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"3a92991c-f94a-4f00-8053-49418ab93629","code":"openai","state":"in_progress","endsAt":null,"bountyId":"5a347e6e-cbbc-4c5f-8725-172a68154d90","startsAt":"2023-04-11T17:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Technology","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/eee6/48ca/31319ece/3b82dca429ba76bf224abbec781356a8_OpenAI-black-monoblossom.png","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2023-04-11T17:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/openai","changelogs":"/engagements/openai/changelog","submissions":null,"announcements":"/engagements/openai/announcements","hallOfFame":"/engagements/openai/hall_of_fames","crowdstream":"/engagements/openai/crowdstream"},"announcementsCount":7,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Priority Triage","submitReportUrl":"/engagements/openai/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":"updated","userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=openai\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/openai/engagement_subscribers","engagementChangelogsUrl":"/engagements/openai/changelog","publishedAt":"2026-11-04T00:53:01.834Z","engagementChangelogUrl":"/engagements/openai/changelog/2ccc3cfa-6f57-4f4d-bb9b-a383df1db634","createUserFeedbacksUrl":"/engagements/openai/feedbacks","engagementCrowdstreamUrl":"/engagements/openai/crowdstream","acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}