Latest in AI
OpenAI Bug Bounty Rewards: What the $172,000 Maximum Actually Means
Higher payouts and a new security sprint put more weight on outside researchers, but the scope and bonus rules matter as much as the headline number.
OpenAI raised its Security Bug Bounty rewards on November 2, with critical findings in core products eligible for up to $30,000 before bonuses. Exceptional findings can reach roughly $172,000 with qualifying bonuses. For researchers, the useful change is how severity, report quality and previous contributions affect the payout.
OpenAI bug bounty payouts and bonuses
The announcement says reward-range midpoints for medium, high and critical findings increased more than fourfold on average. That does not mean every submission receives four times its previous payout.
| Reward category | Announced amount |
|---|---|
| Critical finding in a core product such as ChatGPT, Codex or the API Platform | Up to $30,000 before bonuses |
| Exceptional critical finding on those targets | Up to $100,000 before bonuses |
| Exceptional finding with the illustrated maximum bonus combination | $171,925, rounded to about $172,000 |
The largest figure is a conditional total, not the standard critical bounty. The published calculation multiplies $100,000 by 1.15 for report quality, 1.30 for a priority campaign and 1.15 for the highest loyalty tier.
The live Bugcrowd policy describes five loyalty tiers, with bonuses from zero to 15%. Eligibility starts after two valid lifetime submissions, while the tier depends on impact points from the preceding 12 months. Ratings and final awards remain at OpenAI's discretion.
What qualifies for the security program
Model-only jailbreaks and hallucinations are outside this Security Bug Bounty's scope. A model-assisted attack can qualify when it exploits a separate security flaw in an eligible OpenAI product or OpenAI-controlled integration. Misusing permissions an agent already possesses is treated differently from bypassing a product-enforced boundary.
That distinction matters before a researcher invests time in a report. A surprising model response and a broken access control need different evidence, even when both start with a prompt. Researchers should read the relevant target's current scope rather than assume every agent failure qualifies.
The policy requires testing with accounts you control unless OpenAI authorizes otherwise. If another person's data becomes exposed, stop testing and report the issue without collecting more records. A convincing report should establish the failure without turning a demonstration into a privacy incident.
Existing reports and recent awards
Reports still awaiting a bounty will use the new reward ranges. For awards made during the 30 days before the announcement, OpenAI says it will pay a qualifying difference based on the new base and loyalty awards.
That retroactive calculation is narrower than automatically applying every new bonus to every recent report. Researchers with pending or recently paid findings should check their own case against the published terms.
The Cathedral security sprint is a separate effort
OpenAI also announced a planned internal security sprint with Cathedral. External researchers will work alongside its teams and use OpenAI models to test its defenses. The announcement does not give a start date or detailed testing scope.
OpenAI says its previous sprint involved 25% of its product engineers. Codex helped investigate findings, reproduce vulnerabilities in isolated environments and prepare patches for review. Those are company-reported activities, not an independent measurement of how much risk was removed.
The combination is useful to watch. Internal testing can repeatedly exercise familiar systems, while outside researchers bring different assumptions about where those systems might fail. Paying more for a clear, reproducible report also rewards work that reduces the engineering effort needed to understand and repair a bug.
For AI product teams, the practical question is whether increased discovery leads to faster verified fixes. A larger bounty attracts attention; the response and remediation process determines whether that attention makes the product safer.
I’m Paras. I work at the intersection of AI, engineering and distribution.
I help technical founders explain complex AI products and security updates through clear technical stories that developers and decision-makers can use.