OpenAI Expands Bio Bug Bounty, Doubles Payouts to $50,000 for GPT-5.6 Jailbreaks

OpenAI is expanding its Bio Bug Bounty Program, doubling the top payout to $50,000 for critical GPT-5.6 jailbreaks that bypass biosafety measures. The initiative evolves a pilot program into a permanent, invite-only red-teaming effort to continuously test frontier models against potential biological misuse, establishing a standing line of defense.

How the program changed

Transitioning from a limited-time challenge, the program has evolved significantly. The initial challenge targeted GPT-5.5 with a $25,000 maximum reward for a 'universal jailbreak.' As per a July 9 official announcement, the program now includes GPT-5.6 and offers a doubled top bounty of $50,000 for the same achievement. The original GPT-5.5 track will be consolidated into this new, ongoing program after July 27.

The OpenAI Bio Bounty Program is an ongoing, invite-only initiative that rewards vetted security researchers for finding 'universal jailbreaks' on frontier models. It specifically targets vulnerabilities related to biological misuse, offering up to $50,000 for prompts that can consistently bypass the AI's biosafety guardrails.

Key parameters stay consistent:

• Testers must uncover a single prompt sequence that escapes all five biosafety guards.
• All work is covered by a non-disclosure agreement.
• Access is invite-only, with rolling applications for vetted bio red-teamers.
• Partial victories earn discretionary payouts.

To streamline participation, OpenAI is automatically enrolling all researchers from the GPT-5.5 pilot, so no reapplication is necessary.

Why biosafety jailbreaks matter

The focus on biosafety is critical, as independent studies reveal frontier models' susceptibility to sophisticated attacks. For example, industry reports suggest that "deep inception" prompts can successfully extract significant amounts of restricted content, while other studies have documented substantial failure rates in certain worst-case scenarios. While researchers caution that these jailbreaks grant information access rather than turnkey bioweapon capabilities - a finding supported by security research - a repeatable exploit represents a structural flaw that AI labs must identify and patch in a controlled setting.

Distinction from the public bug bounty

This private bio-focused program operates separately from OpenAI's public Safety Bug Bounty. The public program addresses general platform vulnerabilities and AI abuse but explicitly excludes jailbreak submissions. OpenAI reserves jailbreak testing for limited-access campaigns to prevent dangerous prompts from being widely disseminated.

Placement in the wider policy landscape

Currently, no laws mandate biosecurity testing for AI models, but OpenAI's program aligns with voluntary policy guidance. Frameworks like the EU AI Act require high-risk 'systemic risk' models to document CBRN misuse assessments, while the U.S. NIST AI 800-1 recommends red-teaming for biological threats. By formalizing external testing for each new model, the Bio Bounty Program proactively adheres to this guidance. It also complements OpenAI's internal preparedness framework, which uses confidential metrics to trigger expert reviews.

Early signal from GPT-5.6 testing

Early reports from participants suggest GPT-5.6 is more resilient than its predecessors but can still be compromised by sophisticated, layered role-play prompts. The challenge requires a single prompt that defeats all five biosafety questions, though partial awards are available to better map the model's vulnerabilities. According to industry reports, the doubled $50,000 reward is intended to attract top-tier biosecurity experts and anticipate the challenges of future, more capable models. OpenAI has confirmed that GPT-5.6 will remain in scope indefinitely, integrating this continuous red-teaming process into its standard model deployment cycle.