OpenAI should pay more for bio jailbreaks, not less

GPT-5.6 shows OpenAI is right to keep paying more for universal bio jailbreaks.

OpenAI should keep the Bio Bounty Program private, ongoing, and more generous, because the cheapest way to find a biosafety failure is to pay outsiders to break your system before attackers do.

Security work needs a market, not a memo

The company says the program will now focus on universal jailbreaks that defeat a predefined biosafety challenge across frontier models, starting with GPT-5.6. That is the right target. A one-off bounty can produce a burst of attention, but an ongoing program creates a standing market for the hardest class of failures, the ones that survive model upgrades and policy tweaks.

That matters because biosafety failures are not ordinary product bugs. A prompt that works once against one model family is interesting; a jailbreak that generalizes across frontier systems is a direct test of whether the guardrails are real. If OpenAI wants a meaningful signal, it needs researchers to keep looking after the launch blog post fades.

Private access is the right tradeoff here

Keeping the program private is not a retreat from transparency. It is a practical control on dual-use risk. A public leaderboard for bio jailbreaks would advertise the exact failure modes that the company is trying to suppress, and in this domain the line between red-teaming and enabling misuse is thin.

OpenAI is not asking the public to trust a black box blindly. It is narrowing the scope to predefined challenge conditions and paying for proofs that the safeguards fail. That is a better bargain than open-ended disclosure, because it rewards responsible disclosure without turning the program into a how-to manual for abuse.

Higher rewards are not a perk, they are a filter

The announcement says reward amounts are increasing, and that is the most important operational change in the release. Serious bio safety research takes time, compute, and specialized expertise. If the payout is too small, the program attracts hobbyist probing and shallow demonstrations instead of the kind of rigorous work that can actually break a frontier system.

There is also a talent-market argument. The people capable of finding universal jailbreaks are rare, and they can spend their time on consulting, frontier labs, or offensive security work. A stronger bounty tells them that biosafety is worth their effort. If OpenAI wants the best adversaries in the room, it has to pay like it means it.

The counter-argument

Critics will say this is still the wrong incentive structure. Paying for jailbreaks can normalize the idea that safety is something you buy back after deployment, and a private bounty can look like a substitute for stronger pre-release evaluation. There is also a legitimate concern that any reward program, no matter how carefully scoped, will attract people who are more interested in exploit development than in harm reduction.

That objection is serious, but it misses the operational reality of frontier systems. No internal team can match the diversity of external attack creativity, especially when the target is a model that will be probed by adversaries the moment it becomes useful. The answer is not to avoid bounties; it is to keep them narrow, private, and tied to concrete biosafety challenge failures. OpenAI should treat the bounty as one layer in a larger safety stack, not as a replacement for pretraining controls, evals, and deployment limits.

What to do with this

If you are an engineer, build your safety program as if external researchers will eventually find the path around it, because they will. If you are a PM, define bounty scopes around the failures that matter most, then make the reward high enough to attract specialists instead of curiosity clicks. If you are a founder, copy the operating principle, not the branding: pay for the hardest proof of failure, keep the channel controlled, and treat every serious report as evidence that your guardrails are being tested in the real world.