Openai invites hackers to prod its new brain, will pay cash if it cracks
OpenAI just turned its own chatbot into a piñata and handed the stick to the security crowd. Starting this week, anyone who can make ChatGPT lie, leak, or launch rogue code can walk away with up to $20,000 per bug—so long as the trick works at least half the time.
The hunt is on for prompt injections that scale
Unlike classic bounty programs that chase memory overflows or SQL slip-ups, the Safety Bug Bounty targets the weird new failure modes of generative models: jailbreaks that survive paraphrasing, autonomous agents that order products no human asked for, or hidden instructions that surface only after the user speaks a trigger phrase. In short, behaviors that look less like software glitches and more like dark improv.
The company published a living rulebook. A valid submission must be reproducible in roughly 50 percent of attempts, must bypass safety guardrails, and must produce a real-world risk—data exfiltration, account takeover, or brand-damaging output. Cosmetic oddities and one-off hallucinations are shown the door. Reports that expose model internals, training data echoes, or chain-of-thought logs are explicitly welcome, a rare admission for a firm that once sued to keep such details secret.
Internal triage teams—half policy wonks, half machine-learning engineers—will sort the incoming fire. Low-impact leaks may be downgraded; frontier risks could trigger a private follow-up program with stricter NDAs and fatter checks. OpenAI will not disclose patch timelines, but it promises public credit in its hall of fame, a currency that can turbo-charge a research career.
Timing is not accidental
The bounty drops days after ChatGPT gained plug-ins that can browse, shop, and write code on a user’s machine. Each new capability widens the attack surface; a single convincing prompt could soon equal a stolen credit card or a poisoned GitHub repo. By outsourcing the stress test, OpenAI shields itself from headlines that read “ai went shopping with my wallet” while stockpiling adversarial examples to harden the next training run.
Payouts start at $200 for creative but limited exploits and scale to the five-figure tier for systemic flaws. The ceiling is deliberately lower than the $250,000 Apple once paid for a remote iPhone takeover, reflecting both the youth of the field and the company’s belief that truly catastrophic model bugs remain, for now, rare.
Still, the invitation alone signals a shift. Silicon Valley spent decades telling users to patch their passwords; now it must patch prose. Every successful submission will etch another scar into the myth that large language models are mere stochastic parrots. They are also attack vectors—eloquent, context-aware, and embarrassingly easy to gaslight.
Researchers have 90 days to demonstrate a working attack after initial filing. After that, OpenAI may close the loophole without warning, turning today’s cash cow into tomorrow’s patched footnote. The clock starts now.