Coordinated Vulnerability Disclosure

OpenAI Publishes Outbound Coordinated Vulnerability Disclosure Policy

OpenAI has published a formal outbound coordinated vulnerability disclosure (CVD) policy, establishing how the company will handle and disclose security vulnerabilities it discovers in third-party systems or products. This represents a structured commitment to responsible disclosure practices when OpenAI's research or operations uncover vulnerabilities outside its own infrastructure. The policy signals OpenAI's growing role as a security actor with obligations to the broader ecosystem.