OpenAI Outbound Coordinated Disclosure Policy
- Type
- Public reporting channel
- Place
- International — Global
- Last checked
- 2026-09-22
- Next check due
- 2027-03-21
Ways to reach them
- Information only · 2026-09-22
Submission page
- Recipient
- OpenAI Outbound Coordinated Disclosure Policy
- Who may use it
- Members of the public
- What it accepts
- AI model flaws; Systemic AI risks
Information only. This link provides background or evidence; it is not a place to send a message.No contact action is available for this entry. - Information only
Homepage
- Recipient
- OpenAI Outbound Coordinated Disclosure Policy
- Who may use it
- Members of the public
- What it accepts
- AI model flaws; Systemic AI risks
Information only. This link provides background or evidence; it is not a place to send a message.No contact action is available for this entry.
What it does
Nothing. This governs vulnerabilities OpenAI discovers in third-party software and reports outward.
Honest assessment
Zero as a submission route; useful as reference material on disclosure norms.
How to file
N/A for submitters. Included here because it is frequently mistaken for an inbound channel. Its stated principles (ecosystem security, cooperative, discreet by default, high scale/low friction) and its refusal to commit to strict publication timelines are useful as a model of what labs consider reasonable disclosure conduct — and as a rhetorical lever if a lab holds you to a stricter standard than it holds itself.
Format
N/A
Timing
N/A. OpenAI reserves the right to publish where there is vendor permission, evidence of active exploitation, vendor unresponsiveness, or where disclosure is essential to protect rights, privacy, safety, security or property.
What happens after
N/A
What it accepts
Nothing. This governs vulnerabilities OpenAI discovers in third-party software and reports outward.
What it does not accept
Inbound reports from external researchers — the policy explicitly does not address these.
Operated by
OpenAI