OpenAI × $25,000 | The Full Picture of the GPT-5.5 Bio Vulnerability Bug Bounty
機械翻訳 / Machine-translated
A
AI Friends
2026年4月26日・36分で読める
機械翻訳 / Machine-translated
@aifriends
AI Friends（https://aifriends.jp）のクロスポスト公式アカウント。AIツールの紹介・使い方・できることを、中学生でもわかるやさしい日本語で届けます。
"You shouldn't ask AI bad questions — but what if someone found a backdoor to break the lock?" On April 23, 2026, OpenAI publicly invited external experts to formally try to break the biosafety features of its new model, GPT-5.5, offering a top prize of $25,000 (approx. ¥3.7 million).
This article breaks down questions like "Why run such a dangerous experiment?", "Does this affect Japan?", and "Can ordinary engineers apply?" — in plain language anyone can understand.
Let's organize the announcement in three minutes.
On April 23, 2026, OpenAI simultaneously announced its new model "GPT-5.5" and published a "Bio Bug Bounty" inviting external experts to verify its safety.
A "bounty" refers to a vulnerability discovery program that comes with prize money — a mechanism long used in the security industry.
Think of it like a locksmith shop releasing a new lock and hiring locksmiths from around the world before the launch to try to break it.
The speed of requesting attack testing from experts almost simultaneously with the model announcement is the core news here.
The top prize is $25,000 (approx. ¥3.7 million). The condition for receiving it is discovering a "Universal Jailbreak" — a reusable attack prompt that can break through all five of GPT-5.5's biosafety challenges with a single prompt.
The full amount goes to a researcher who can create the equivalent of "one master key that opens five safes."
Partial successes (e.g., breaking through only 3 of the 5 challenges) may still earn a discretionary reward from OpenAI, leaving room for less experienced participants to succeed.
By making researchers' contributions visible in dollar terms, the clear aim is to dramatically raise both the quality and quantity of safety verification.
The application period runs from April 23 to June 22, 2026, with the actual testing period from April 28 to July 27 — a short, approximately three-month sprint.
The timeline resembles a summer science project, with skilled participants from around the world diving in simultaneously. Applications are submitted through OpenAI's dedicated portal, with candidates demonstrating experience in AI red-teaming, cybersecurity, or biosecurity expertise.
It's a narrow gate, but the transparency is high — in keeping with the conventions of modern open science.
Let's look at "Why specifically bio, rather than COPA or general vulnerabilities?" from three angles.
Reports from governments and organizations like CSIS (Center for Strategic and International Studies) place "the possibility that AI could evolve to a level where non-experts can acquire knowledge of biological weapons" at the very top of AI risk rankings.
The risk lies in the shift where "specialized texts that once required a PhD to write can now be read by anyone who asks an AI in one minute."
It carries the same gravity as asking: "What if ordinary people could synthesize poison just by reading instructions at the local pharmacy?"
The fear that AI could become a bridge connecting malicious individuals to nation-state-level destructive power is why biosafety receives such concentrated investment.
In 2024, OpenAI published the "Preparedness Framework," a safety evaluation system to be applied before releasing new models.
It measures risk levels across four domains — bio, cyber, persuasion, and autonomy — and is designed to delay release if thresholds are exceeded.
It's the same idea as the automotive industry's requirement to conduct crash tests before a new car goes on sale. This bounty program is part of that framework — a measure to bring in external experts and sharpen the accuracy of those crash tests.
As a modern safety engineering practice that borrows the world's best minds because internal testing alone leaves blind spots, it has attracted significant industry attention.
GPT-5.5 itself has made major advances in "agentic coding capabilities," "computer operation," and "scientific research," with a massive 400K-token context window that lets it handle long documents and papers all at once.
This is a leap equivalent to going "from a thin dictionary to an encyclopedia filling an entire library."
The smarter it gets, the higher the risk that it will provide structured answers even to dangerous questions — which is precisely why verification by an external red team is indispensable.
OpenAI's current policy can be read as advancing capability enhancement and safety verification together, at the same pace.
Here's how the "five biosafety challenges" that applicants attempt to break through actually work.
Each challenge starts from a "clean chat" — a completely fresh conversation. That means techniques where you gradually lower the AI's guard through setup and priming cannot be used.
The difficulty is like "asking someone you've just met to hand over a key — and getting an immediate yes."
The program's toughness lies in only rewarding attacks that satisfy three conditions: a one-shot attempt, universal applicability, and reproducibility.
The design philosophy is clearly to verify attacks in the form closest to real-world misuse scenarios.
Testing is limited to GPT-5.5 within OpenAI's IDE-style application "Codex Desktop" — a representative environment for executing agentic tasks, including external API access and file operations.
It's like "inspecting ingredients in an actual kitchen rather than a lab petri dish."
The standard is to evaluate only attacks that can truly be reproduced in a real-world environment, not purely theoretical vulnerabilities.
The intent to surface attacks targeting the real-world environment before agentic AI begins operating in earnest is unmistakable.
All applicants are required to sign an NDA (non-disclosure agreement) and verify their identity via an existing ChatGPT account.
The binding rule: "Attack methods discovered, AI responses, and data obtained during testing cannot be disclosed publicly in any form."
Think of it as: "We'll ask a locksmith to break a new lock, but they can't talk about how they did it outside."
This is a fundamental principle of safety operations: don't let information reach those who would misuse it.
Given that biosecurity exploit information, once leaked, cannot be recalled, the design is extremely cautious.
Here's a side-by-side comparison of the safety approaches of the Big Three.
In May 2025, Anthropic released Claude Opus 4 under "AI Safety Level 3 (ASL-3)." ASL-3 is the rigorous level applied to models that "substantially enhance the ability of individuals with basic science knowledge to acquire biological, chemical, or nuclear weapons."
The defining feature is "Constitutional AI," an approach in which the model itself learns and applies safety principles.
Think of it as: "OpenAI's model — assigning a personal tutor — vs. Anthropic's model — having the child internalize the rules of the house."
The two approaches agree on tightening capability evaluation; the industry's take is that they differ philosophically on how to reduce risk.
Google DeepMind has also updated its "Frontier Safety Framework" and strengthened governance for Gemini 3.1. April 2026 research reportedly showed both companies' models scoring high on quantitative benchmarks, though Gemini was flagged for weaknesses in contextual understanding.
All three companies got the same homework, but they're top students with very different answer styles.
In the Future of Life Institute's 2025 safety index, of seven companies evaluated on dangerous capability testing, only Anthropic, OpenAI, and DeepMind received recognition.
The reality is that only a handful of companies can conduct front-facing evaluations of bio- and cyber-level risks.
Meanwhile, large open-source models such as Meta Llama, Mistral, and DeepSeek present the issue that safety guardrails can be stripped away after the fact.
It's like: "Even if the knife maker designs a safe product, the buyer can file it down and use it as a weapon."
The industry-wide dilemma is that the stronger closed AI safety measures become, the more misuse shifts toward the open-source side.
OpenAI's bounty program is positioned as a symbol of the collective safety responsibility of the closed AI camp.
Let's look at "How does an overseas story relate to Japan?" from three angles.
On June 4, 2025, Japan promulgated the "Act on Promotion of Research, Development, and Utilization of Artificial Intelligence-Related Technologies (New AI Act)." An AI Strategy Headquarters was established within the Cabinet, with the Prime Minister at the helm, and national-level AI strategy has begun to move.
This is like: "Once traffic laws were created, it became clear that each company was obligated to equip their vehicles with safety features."
Industry observers believe OpenAI's bounty program is likely to be cited as a practical example of the "enhanced risk management" called for in Japan's AI Business Guidelines v1.1.
Starting in 2026, the Ministry of Internal Affairs and Communications will begin developing an "AI base system for evaluating the reliability and safety of generative AI" at the National Institute of Information and Communications Technology (NICT).
The policy is to "build a national-level gymnasium for AI safety testing."
The vision is something like "companies bring their AIs together, they're put through their paces, and the government publishes safety scores."
Not only domestic Japanese models, but also the safety of overseas models used domestically is expected to fall within scope.
OpenAI's efforts will directly feed into Japan's national projects as reference cases.
Domestic AI developers such as NEC, Fujitsu, PFN, ELYZA, and the University of Tokyo's Matsuo Lab are all conducting their own safety verification. However, the bold bounty culture of offering prize money to invite global experts to mount attacks is almost entirely absent from Japanese companies.
It's like: "Clinical trials for new drugs are standard, but clinical trials for AI models are confined to the research lab."
The question is how quickly Japanese AI companies can absorb the external red-teaming expertise that OpenAI has pioneered.
Experts warn that this gap will have a decisive impact on the credibility of Japan's AI industry five years from now.
Kiryu works at a cybersecurity firm auditing generative AI and has been conducting research on AI prompt injection both inside and outside the company.
He has "a track record of two wins in OpenAI's Safety Bug Bounty, receiving a combined prize of ¥600,000." He plans to apply for this Bio Bug Bounty as well, saying, "Aiming for a universal jailbreak is extremely difficult, but the fact that discretionary rewards are available for partial breakthroughs makes it a realistic target."
The standard flow: applying through OpenAI's dedicated portal, signing an NDA, and providing proof of past red-teaming work.
A new career path is taking root — one where AI security researchers can have their skills evaluated in prize money — and that trend is beginning to spread in Japan too.
Hiruma, Chief Science Officer at a drug discovery startup, is in the middle of reviewing the company's internal ChatGPT usage rules.
He is grappling with the difficult question of "how much should employees be allowed to ask AI about pathogens or toxic substances in the course of their research work?" Following the announcement of OpenAI's Bio Bug Bounty, he added a clause to the internal guidelines: "Questions related to drug discovery and toxicology research must only be conducted in a dedicated closed environment."
The reasoning: "If even OpenAI is conducting this level of careful testing publicly, we should manage things internally at the same level."
The trend of biotech companies' AI usage policies being pulled toward global safety standards is accelerating across the entire industry.
Komada, an IT systems manager at a major manufacturer, holds monthly training sessions on internal generative AI usage.
He has decided that "this month's topic is real-world examples of prompt injection." Using OpenAI's Bio Bug Bounty as material, he plans to explain "why an attack that reuses the same prompt repeatedly is called 'universal.'"
"Being able to cover cutting-edge global cases in training" directly raises employee AI literacy.
The ability to quickly absorb global trends into internal training is becoming a key performance indicator for IT departments.
The skill of translating news from "something happening elsewhere" into "a problem for our own company" is solidifying as a new essential capability for IT professionals.
A. Technically yes, but in practice, specialized experience is essential. OpenAI requires applicants to demonstrate one of the following: AI red-team experience, a cybersecurity track record, or biosecurity expertise.
Think of the barrier as "an amateur shogi player at third dan challenging a professional tournament."
Applications require presenting evidence of past vulnerability discoveries or relevant publications.
For those without a track record, the conventional wisdom is to first build experience through OpenAI's general-audience Safety Bug Bounty.
A. It is a mid-range figure in terms of industry vulnerability bounties. Microsoft, Google, Apple, and others offer large bounties in the hundreds of thousands of dollars, so the amount itself is not exceptional.
In terms of positioning, it's roughly like earning three stars in a prestigious restaurant guide.
However, the impact and social significance of the research involved are extraordinary.
The true appeal is not the prize money itself, but the fact that having your name appear in OpenAI's official safety evaluation report becomes a career asset in its own right.
A. In principle, no — due to the NDA (non-disclosure agreement). Prompts, model responses, and vulnerability details obtained during testing must all be reported exclusively within OpenAI.
It's like being "an outside consultant brought in to work on a major manufacturer's new product development, bound under strict confidentiality."
After a certain period, OpenAI may anonymize and partially disclose some content, but individual researchers' own publications require review.
Because biosecurity exploit information has an outsized societal impact, the restrictions are stricter than for typical bounty programs.
A. Against known attacks that OpenAI has currently detected, "strengthened" is the accurate characterization. By the same token, OpenAI itself is implicitly acknowledging through this bounty program "the possibility that unknown attacks may yet be discovered."
It's the same as: "A new car may pass all safety tests and still be involved in unforeseen accidents."
A bounty program is not proof of perfection — it is a continuing mechanism for patching holes that have yet to be found.
The correct understanding is that AI safety is not a destination but a dynamic state that is continuously updated.
A. Three steps are practical. First, review internal AI usage guidelines and explicitly document question rules particularly for medical, chemical, and life sciences domains. Second, establish contractual arrangements with external AI red-team vendors. Third, monitor developments in the New AI Act and NICT infrastructure and reflect them in company policy.
Think of it as "the same procedure as reviewing how company vehicles are used when new traffic rules come into effect."
Rather than aiming immediately for international standards, the conventional roadmap is to work through: internal guidelines → industry associations → government directives, in that order.
"Making AI unable to answer malicious questions" — a seemingly low-key effort that has now become the biggest battleground at the frontier of global AI development. OpenAI's boldness in mobilizing brilliant minds from around the world on the attack side with $25,000 on the line, the real-environment testing in Codex Desktop, the rigor of NDA signing and identity verification — all of it symbolizes the serious safety engineering of frontier AI.
Advancing capability enhancement and safety verification together, at the same pace, as a duo — that is the common language shared by the Big Three: Anthropic, Google DeepMind, and OpenAI. For Japanese companies as well, establishing a domestic bounty culture in concert with the New AI Act and NICT infrastructure is a management decision that will determine credibility five years from now.
"AI safety is not something someone will complete for us — it is something society builds together, continuously" — we are now crossing the threshold into that new common sense. Seen this way, the weight of this announcement comes into focus.
This article is a cross-post from AI Friends.
