OpenAI raised its security bug bounty cap to $172,000

Security researchers at OpenAI's bug bounty program just got a raise. The math now works in favour of anyone with a report in a drawer.

OpenAI said on 2 November that it is raising its security bug bounty rewards. Critical findings in core products now pay up to $30,000 at base rate. Exceptional reports can reach $172,000 once bonuses are counted.

OpenAI says the midpoint of its reward ranges for medium, high and critical findings has more than quadrupled on average. The core products that get the top rate are ChatGPT, Codex and the API Platform. OpenAI says exceptional critical findings there stay eligible for up to $100,000 before bonuses. Bonuses can push the total to $172,000.

New bonus programs

OpenAI added three bonus layers on top of the base amounts. A report quality bonus pays a multiplier on the base bounty for high-quality reports. A loyalty bonus has five tiers and adds scaling payments for researchers who report more than once. A priority campaign bonus pays extra for findings on targets OpenAI names for a given period. OpenAI did not publish the exact multiplier each bonus uses.

Retroactive to 30 days

The new ranges apply to reports that have not received bounties yet. For bounties already paid out in the 30 days before the announcement, OpenAI said it will pay the difference. The condition: the finding must have earned more under the new ranges. A researcher who filed a critical report in October may be owed money.

Security sprint with Cathedral Systems

OpenAI said it is also preparing an internal security sprint with Cathedral Systems. Cathedral's researchers earlier this year used AI agents to reach inside Anthropic's business systems in a test. OpenAI said Cathedral's researchers will use OpenAI's own models next to its security team to challenge its defences. OpenAI said its security team will also be at PROMPT2PWN in Oakland on 20 and 21 November. Researchers can test targets in person there.

The timing matters for anyone who runs a security research practice. OpenAI's own models get better at finding bugs each release. That raises the pay a human can earn by moving first. The retroactive clause means a researcher does not have to pick between filing now or waiting for better rates. One number stays missing. OpenAI has not published the exact bonus multipliers. The stated $172,000 cap depends on hitting bonus tiers the company does not define in public.

Source

OpenAI, "Rewarding defenders with bigger bug bounties". Secondary reporting: Unite.AI.