OpenAI's Bio Bug Bounty opened for testing today.
The challenge is blunt: find one prompt that makes GPT-5.5, running inside Codex Desktop, cleanly answer all five biosafety questions without tripping any review mechanism. The first researcher to do it gets $25,000.
It sounds like a CTF. In practice, the bar is much stricter.
What makes this bounty unusual
The structure is narrow by design:
- Payout: $25,000 goes to the first researcher who completes all five questions; partial but useful findings may still receive discretionary awards.
- Environment: testing is limited to GPT-5.5 inside Codex Desktop. Other entry points do not count.
- Window: applications run from April 23 to June 22, while testing runs from April 28 to July 27.
- Disclosure: participants must sign an NDA, and test data, prompts and findings cannot be published.
The key phrase is "universal jailbreak." OpenAI is not asking whether one individual question can be broken. It wants proof that a single prompt can solve all five questions.
That changes the red-team problem. Most AI red teaming optimizes against one case at a time. Here, OpenAI is asking researchers to show that one prompt can move GPT-5.5 across five biosafety guardrails while the review system remains unaware throughout.
Why Codex Desktop
This is the counterintuitive part.
GPT-5.5 can be reached through the web, API, Codex CLI and Codex Desktop. OpenAI has chosen only Codex Desktop for this test.
There are two plausible reasons. First, Codex Desktop is a developer-facing, agent-like environment. Its sandbox boundaries, permissions and context handling are different from the web version of ChatGPT. If a biosafety jailbreak works there, it points to a problem in the security boundary for agentic deployment, which is exactly the kind of risk OpenAI has been watching closely.
Second, it controls the variables. Keeping the test surface fixed makes red-team reports easier to compare and reduces noise from prompt-template differences across product entry points.
The limit also matters. Attacks against ChatGPT on the web, mobile clients or direct API calls are outside this bounty. The $25,000 is buying evidence about a very specific safety boundary, not proof that GPT-5.5 is robust everywhere.
What are the five questions?
OpenAI has not disclosed them, and the NDA prevents participants from leaking them.
The likely shape is clear enough: five expert-selected questions that, if answered fully, could accelerate harmful biological research. Anthropic has run related Constitutional Classifiers tests over the past year, but OpenAI's version is more aggressive because it combines red teaming with a bounty structure.
It is also worth comparing with Anthropic's earlier Mythos Preview approach, which invited 40 companies to look for vulnerabilities. OpenAI's Bio Bounty is invitation plus application, focused on specialist red-teamers and on one extreme category: biosafety.
Anthropic is testing with an enterprise ecosystem. OpenAI is stress-testing the edge of a single isolated scenario.
The real signal
The interesting question is not whether $25,000 is enough to attract elite red-team talent. In the AI red-team market, that is not a huge prize. Google's VRP and Meta's bug bounty programs can reach six figures.
The real signal is the three-month test window.
If someone wins within three months, GPT-5.5's biosafety guardrails have a systematic weakness that OpenAI will need to patch in a later GPT-5.5 Pro safety update.
If nobody wins, OpenAI gets a public, credible record that a red-team challenge failed to break the system. That is more useful than another self-congratulatory safety report.
This is the first time OpenAI has used a bounty mechanism to publicly test a single class of model guardrails. Earlier bug bounty work covered broader model safety and privacy issues. This one locks directly onto biosafety.
Anyone watching the industry knows why. AI biosafety is a 2026 regulatory priority. The White House National Policy Framework and the EU AI Act both place biological risk among the highest-concern categories.
OpenAI is collecting evidence before the detailed rules arrive.
The next three months should be revealing.
Sources: GPT-5.5 Bio Bug Bounty (OpenAI official); CocoLoop; GPT-5.5 Bio Bug Bounty Program Aims to Improve AI Safety and Performance (GBHackers); OpenAI offers $25,000 reward to hack GPT-5.5 safety controls (VARindia)