OpenAI raises Security Bug Bounty rewards, with critical findings up to $30,000 and new bonuses

OpenAI is raising rewards in its Security Bug Bounty program and adding bonuses for higher-quality reports. It says it is more than quadrupling the midpoint of reward ranges for medium, high and critical findings on average.

Details

• New ceilings: A critical vulnerability in a core product such as ChatGPT, Codex or the API Platform earns up to $30,000. Exceptional critical findings remain eligible for up to $100,000, and now up to $172,000 with bonuses.
• Quality multiplier: Reports with a reliable proof of concept that isolates the bug, shows when it is exploitable and demonstrates impact can earn a bonus multiplier on the base bounty.
• Loyalty bonuses: A new 5-tier loyalty system gives scaling bonuses to researchers who report repeatedly.
• Priority campaigns: Short-term campaigns with dedicated bonus pools for newly launched features.
• Worked examples (illustrative): A medium ChatGPT bug previously about $750 becomes $2,000 x 1.15 x 1.05 = $2,415. A one-click account takeover previously $6,500 becomes $30,000 x 1.15 x 1.30 x 1.15 = $51,577.
• Retroactive payments: Pending reports get the new ranges. For bounties awarded in the 30 days before the announcement, OpenAI will pay the difference if the finding would have earned more.
• Event: OpenAI’s security team will be at PROMPT2PWN in Oakland on November 20-21.
• Undisclosed: Per-tier loyalty multiplier values are not listed in the post; full terms are on the Bugcrowd program page.

What’s next

The post presents the bounty as a complement to OpenAI’s internal Defense Factory work, in which engineers use its models to find, reproduce and fix weaknesses.