OpenAI Boosts Security Bug Bounty Rewards and Bonuses
OpenAI is significantly raising its security bug bounty payouts and introducing new incentives aimed at independent security researchers.
Radwan AbdulhadiEditor and technology writer
Raising Rewards for Independent Researchers
OpenAI has announced an update to its Security Bug Bounty program designed to further encourage independent researchers to find vulnerabilities in software that internal testing may have missed. According to OpenAI News, the organization is more than quadrupling the midpoint of its reward ranges on average for medium, high, and critical findings.
Independent security researchers play a critical role in protecting technology across the industry. Responsible disclosure forms an essential part of the company's security model, working alongside efforts like the Defense Factory where engineers leverage models to identify weaknesses, reproduce them, and test fixes.
New Payout Structure and Base Ranges
Under the updated guidelines, finding a critical vulnerability in core products such as ChatGPT, Codex, or the API Platform can earn up to $30,000. Exceptional critical findings on these targets remain eligible for up to $100,000, and can reach up to $172,000 when combined with various bonuses. Comprehensive details are outlined within the security bug bounty program guidelines.
Quality, Loyalty, and Priority Incentives
To reward thorough investigative work, OpenAI is introducing report quality multipliers. A reliable proof of concept that isolates a bug, demonstrates when it can be exploited, and shows its impact gives the engineering team a head start on implementing a fix, earning a bonus multiplier on the base bounty.
Additionally, a tiered loyalty bonus system is being established to build long-term relationships with the security community. This five-tier system provides scaling bonuses to recognize researchers who consistently partner with the organization to improve AI safety. Short-term priority campaigns will also feature dedicated bonus pools for newly launched features, giving researchers early opportunities to test new developments.
Retroactive Adjustments and In-Person Engagement
For reports that have already been submitted but not yet awarded a bounty, OpenAI will apply the new reward ranges. For bounties awarded in the 30 days prior to the announcement, the company will pay the difference if the finding would have earned a higher amount under the revised ranges.
The security team will also connect with researchers in person at PROMPT2PWN in Oakland on November 20–21, where attendees can test targets and discuss ongoing collaboration opportunities.
Sources
- OpenAI NewsRewarding defenders with bigger bug bounties
Continue chronologically
Related entity coverage
Related stories
OpenAI Doubles Pro Limits and Brings Work Features to Chat
OpenAI is doubling Pro usage limits, rolling out ChatGPT Work capabilities into regular Chat, and combining usage allowances across ChatGPT and Codex.
OpenAI and ServiceNow Expand Enterprise AI Workflows
OpenAI and ServiceNow have announced an expanded partnership to bring advanced AI models and agents into enterprise workflows, ChatGPT, and Codex.
OpenAI and Oracle Expand Partnership to Bring Apps to ChatGPT
OpenAI and Oracle expand their commercial partnership to integrate business applications and AI agents into ChatGPT and power new Oracle offerings.
OpenAI Adding Invisible Watermarks to EU Text and Code
OpenAI is rolling out invisible text watermarking for ChatGPT and Codex in the European Union to comply with regional AI transparency rules.
