Rewarding Defenders with Bigger Bug Bounties
OpenAI, Monday, November 2nd, 2026
OpenAI raises Security Bug Bounty rewards, with critical core-product bugs now paying up to 30,000 dollars, and adds bonuses.
OpenAI is more than quadrupling, on average, the midpoint of its bug bounty reward ranges for medium, high and critical findings.
A critical vulnerability in a core product such as ChatGPT, Codex or the API Platform now earns up to 30,000 dollars, and exceptional critical findings remain eligible for up to 100,000 dollars, or up to 172,000 dollars with bonuses.
New incentives include a quality multiplier for reports with reliable proofs of concept, a five-tier loyalty bonus program and priority campaigns with bonus pools for newly launched features.
Unpaid pending reports get the new ranges, and bounties awarded in the prior 30 days will be topped up where they would have earned more.