OpenAI has published an Outbound Coordinated Disclosure Policy setting out how it reports security vulnerabilities it finds in third-party and open-source software, the company said on 9 June 2025.
OpenAI said its systems have already found zero-day vulnerabilities in third-party and open-source software, and that coordinated disclosure will become necessary as AI systems get better at finding and patching security flaws.
The policy covers issues found through automated and manual code review and through internal use of third-party software. It explains how OpenAI validates and prioritises findings, how it contacts vendors, and when it goes public, with disclosure non-public by default.
OpenAI has chosen to leave disclosure timelines open-ended by default, saying it expects its models to detect more bugs of increasing complexity that may need more time to resolve. It reserves the right to disclose earlier when, for example, there is a public interest in doing so.
The company said it will keep updating the policy as it learns.