OpenAI AI Updates: April 25, 2026

1. OpenAI Opens GPT-5.5 Bio Bug Bounty With $25,000 Prize for Universal Jailbreaks

OpenAI. OpenAI launched the GPT-5.5 Bio Bug Bounty, a red-team challenge that pays up to $25,000 for a single universal prompt that bypasses GPT-5.5’s bio safety filters and answers all five gated bio questions from a clean chat without triggering moderation. Smaller discretionary rewards are available for partial findings. Applications opened April 23 and run on a rolling basis through June 22, 2026; the testing window runs April 28 to July 27, with vetted bio red-teamers signing an NDA and using their own ChatGPT accounts. Source

2. Codex App Adds GPT-5.5, In-App Browser Use, and Automatic Approval Reviews

OpenAI. GPT-5.5 landed in the Codex CLI, IDE extension, and Codex app as the recommended default for coding, refactors, debugging, testing, and knowledge work, swappable via codex --model gpt-5.5 or /model. The Codex app gained browser use, letting Codex drive a bundled in-app browser against local dev servers and file-backed pages to click through UIs and reproduce visual bugs, with allow/block lists in settings. The same release wires up automatic approval reviews, which route eligible approval prompts through a reviewer agent that surfaces a risk level before the request runs. Source

3. Codex CLI 0.125.0 Ships Unix Socket Transport, Remote Plugin Install, and Permission-Profile Round-Tripping

OpenAI. Codex CLI 0.125.0 expanded the app-server integration surface with Unix socket transport, pagination-friendly resume/fork, sticky environments, and a remote thread config/store, plus an RPC that lets the app-server install remote plugins and upgrade configured marketplaces. Permission profiles now round-trip across TUI sessions, user turns, MCP sandbox state, shell escalation, and app-server APIs, and model providers own their own model discovery with AWS Bedrock account state exposed to clients. codex exec --json now reports reasoning-token usage, and rollout tracing records tool, code-mode, session, and multi-agent relationships with a debug reducer command. Source