OpenAI is paying independent security researchers a lot more to find holes in its products. The company announced on November 2 that it’s raising its Security Bug Bounty rewards and adding three new bonuses: one for report quality, one for loyalty and one for priority campaigns. According to OpenAI, the goal is to reward the “defenders” who keep systems like ChatGPT, Codex and the API Platform safe.
⚡ The Quick Version
If you’re short on time, these are the main points:
- Base rewards jumped. Reported coverage of the announcement says the midpoints of the medium, high and critical reward ranges more than quadrupled.
- Critical bugs in core products can pay up to $30,000. That covers ChatGPT, Codex and the API Platform.
- Exceptional findings start at a $100,000 base. With stacked bonuses, they can reach about $172,000.
- The new bonuses stack on top of each other.
- It applies backward too. Reports still waiting for an award get the new ranges. Researchers paid in the 30 days before the announcement get the difference.
💰 How the New Bonuses Work
The headline numbers matter, but the bonus structure is the more interesting design choice. OpenAI is now paying for how researchers work, not only for what they find.
- Quality bonus. A strong, well-documented report earns a 1.15x multiplier on the base bounty. Clear reproduction steps and solid impact analysis save the triage team hours, so OpenAI is paying for that.
- Loyalty program. A five-tier system, with levels like Bronze and Gold, adds percentage bonuses for researchers who keep submitting over time.
- Priority campaigns. Dedicated reward pools target new features. When OpenAI ships something new, it can point researchers at it with extra money attached.
One caveat: some coverage notes that OpenAI didn’t fully spell out whether the changes apply to every report type. Researchers should check the program terms before counting on a specific payout.
📈 How We Got Here
This is the third big step for the program. OpenAI launched its bug bounty in April 2023 with Bugcrowd, paying from $200 for low-severity bugs up to $20,000 for exceptional ones. In 2025 it raised the top payout to $100,000 for exceptional critical findings and ran limited-time bonus promotions.
That $100,000 figure is now the starting base for top-tier findings, not the ceiling. The everyday ranges for medium, high and critical bugs, which is where most researchers actually earn, also grew a lot.
🛡️ Why This Matters
What stands out to me is the timing. OpenAI’s attack surface looks very different than it did in 2023. Codex writes and runs code. Agents browse the web, call tools and act for users. Every new feature that touches real systems gives attackers another way in.
There’s also a talent fight going on. Top security researchers have options: other AI labs, big tech bounty programs, private vulnerability brokers. Bigger payouts and loyalty perks are how OpenAI keeps skilled people reporting to OpenAI instead of somewhere else.
The loyalty tiers say a lot. A researcher who knows OpenAI’s systems well finds deeper bugs faster than a newcomer. Paying people to stay is cheaper than repeatedly teaching new ones the codebase.
🔭 What to Expect Next
- More researchers looking at OpenAI products. Higher pay draws attention, so expect more reports, especially on new launches with priority campaigns.
- Pressure on other AI labs. If you’re a competitor running a smaller bounty program, this resets the market rate. Matching bounties seems likely.
- Better reports overall. The quality multiplier pushes researchers toward thorough write-ups over quick, low-effort submissions.
- For security teams elsewhere: if you’re building on OpenAI’s API, a better-funded bounty means more eyes on the platform you depend on. You still need to secure your own integration layer.
I think this is a smart move. As AI products take on more real-world actions, a strong outside security community starts to look like core infrastructure, and OpenAI is pricing it that way. The full reward tables and program terms are in OpenAI’s original announcement.