# Rewarding defenders with bigger bug bounties

Date: 2 Nov 2026
Released by: OpenAI

## MediaRelease.co Summary

OpenAI is raising rewards in its Security Bug Bounty program, more than quadrupling the midpoint of reward ranges for medium, high and critical findings on average. A critical vulnerability in ChatGPT, Codex or the API Platform can now earn up to $30,000, and exceptional findings up to $172,000 with bonuses. New incentives include quality multipliers, a five-tier loyalty program and priority campaign bonuses, with retroactive payments for recent awards.

## Original release

We’re raising rewards in OpenAI’s Security Bug Bounty program to further encourage independent researchers to pursue vulnerabilities in OpenAI software that our testing may have missed. We’re also introducing new incentives for researchers to earn more for higher quality vulnerability reports. Independent security researchers play an essential role in protecting technology across the industry. At OpenAI, incentivizing responsible disclosure is a core part of our security model, complementing our Defense Factory work, where our engineers use our models to find weaknesses, reproduce them, and test fixes. Today’s updates are designed to encourage and empower researchers, and to continue building a collaborative, community-first security environment. Serious vulnerabilities get serious rewards We’re more than quadrupling the midpoint of our reward ranges for medium, high, and critical findings on average. A critical vulnerability in a core product such as ChatGPT, Codex, or the API Platform will now earn up to $30,000. Exceptional critical findings on those targets remain eligible for up to $100,000, and now up to $172,000 with bonuses. The full details are available in our security bug bounty program . High quality report bonus multipliers High-quality reports will be eligible to earn a bonus multiplier on the base bounty. A reliable proof of concept that isolates the bug, shows when it can be exploited, and demonstrates its impact gives us a head start on a fix. The quality multiplier recognizes the extra work that makes a finding especially useful. Loyalty program bonuses To build long-term relationships and continuously empower our security community, we are introducing a tiered loyalty bonus program. This 5-tier system provides scaling bonuses to recognize, support, and celebrate researchers who consistently partner with us in making AI technology safer for everyone. Priority campaign multipliers To support community engagement as technology evolves, priority campaigns will feature dedicated bonus pools for newly launched features. These short-term campaigns give researchers early, high-reward opportunities to test new developments and be recognized for their early contributions. Updated payout calculation examples Example vulnerability Example historical award Example new payout calculation New reward Medium - ChatGPT (core asset): A read-only member can upload files to a Project without write permission. $750 $2,000 × 1.15 Quality Bonus × 1.05 Bronze Loyalty Tier Bonus $2,415 High - Prism (non-core asset): IDOR resulting in reading a file uploaded to user’s Project $1,000 $2,500 × 1.15 Quality Bonus × 1.10 Gold Loyalty Tier Bonus $3,162.50 Critical - ChatGPT (core asset): One-click account takeover. $6,500 $30,000 × 1.15 Quality Bonus × 1.30 Priority Campaign Bonus × 1.15 31337 Loyalty Tier Bonus $51,577 Exceptional - ChatGPT (core asset): Significant compromise of a security boundary (e.g., ability to view arbitrary ChatGPT users’ chat messages.) $100,000 $100,000 × 1.15 Quality × 1.30 Priority Campaign × 1.15 31337 loyalty $171,925 All scenarios and historical awards are illustrative. Retroactive payments If you’ve already submitted a report and we haven’t yet awarded a bounty, we’ll apply the new reward ranges. For bounties we awarded in the 30 days before this announcement, we’ll pay you the difference if your finding would have earned more under the new ranges (Base Award + Loyalty Awards). Meet us in Oakland On November 20–21, our security team will be at PROMPT2PWN in Oakland, where researchers can test targets in person. If you’ll be there, we’d love to hear what you’ve been working on and how to partner with you. Thank you to everyone who has taken the time to investigate a lead and report it to us. We want OpenAI to be a team you come back to when you find something we’ve missed.

## Key details

- Issued by: OpenAI
- Published: 2 Nov 2026
- Publisher country: United States
- Subject country/region: United States
- Topics: AI

Original source: https://openai.com/index/rewarding-defenders-with-bigger-bug-bounties/
MediaRelease.co canonical URL: https://mediarelease.co/us/mr02556-openai-bigger-security-bug-bounties-rewards-02112026.html