OpenAI turns its bio jailbreak bounty into a permanent private program and doubles the top payout

From a one-model test to a rolling program

The core change here is structural. What began as the GPT-5.5 Bio Bug Bounty—a bounty tied to a specific model—is becoming the OpenAI Bio Bounty Program, described as an ongoing private program. Instead of standing up a fresh test each time a new frontier model ships, OpenAI is committing to carry the same challenge forward. The program starts with GPT-5.6 and, per the announcement, continues 'going forward.'

The transition is handled with an explicit handoff date rather than a hard cutover. OpenAI says it will honor the original GPT-5.5 scope with testing ending July 27, 2026, after which only GPT-5.6 remains in scope. Existing applicants to the GPT-5.5 program do not need to reapply, which suggests OpenAI wants to keep the researcher pool it already vetted rather than rebuild it per model.

The narrow target: a universal jailbreak against a fixed biosafety challenge

This is not an open-ended hunt for any biology-related weakness. The program is focused specifically on 'universal jailbreaks that can defeat our predefined biosafety challenge.' That phrasing matters: there is a defined challenge the model is meant to withstand, and the bounty pays for a method that generally defeats it, not for a single lucky prompt.

OpenAI reinforces the distinction by noting that 'smaller awards may be granted for partial wins at our discretion.' The full payout is reserved for the universal case, with partial results treated as lesser—and discretionary—results. That framing tells researchers exactly what OpenAI considers the high-severity outcome worth pricing at the top of the scale.

Doubling the top reward, and what the number signals

The reward for a universal jailbreak for the OpenAI Bio Bounty Program has been raised from $25,000 to $50,000 for both GPT‑5.6 and GPT‑5.5.Montana Labs

Doubling the headline reward is the most concrete change in the post. Applying the new $50,000 figure to both GPT-5.6 and GPT-5.5 also means the raise is retroactive to the model still in scope until late July, not just the incoming one. A bounty amount is a rough statement of how hard OpenAI expects the problem to be and how much it values a demonstrated break; raising it while keeping the target narrow suggests the first round did not surface easy wins.

A gated, NDA-bound researcher pipeline for a sensitive risk area

Access is deliberately controlled. Applicants submit a short application with name, affiliation, and experience; must have an existing ChatGPT account; and must sign an NDA before being onboarded to the bio bug bounty platform. This is a private, rolling-admission program, distinct from OpenAI's separately linked Safety Bug Bounty and Security Bug Bounty tracks.

The gating fits the subject matter—biorisk testing produces exactly the kind of findings you would not want disclosed publicly—but it also shapes who participates and what feedback the wider security community ever sees.

The implication: OpenAI is treating biorisk jailbreak resistance as a per-model, continuously priced obligation

By detaching the bounty from a single model version and attaching it to whatever frontier model is current, OpenAI is signaling that resistance to biosafety jailbreaks is now a recurring release requirement, not a one-time launch test. The scheduled July 27 scope shift and the promise to 'continue to communicate any future changes in scope' establish a cadence: each frontier model inherits the same challenge and the same $50,000 target. For teams shipping high-capability models, the takeaway is concrete—safeguards against a defined threat class are being maintained as an ongoing, externally tested line item rather than a checkbox cleared at launch.