OpenAI Raises Security Bug Bounty Rewards, Offering Up to $172,000 for Critical Core Product Flaws
OpenAI announced it has more than quadrupled the midpoint of its reward ranges for medium, high, and critical findings, introducing new quality, loyalty, and priority campaign bonuses.
US-based artificial intelligence company OpenAI announced on November 2, 2026, a significant increase in rewards under its Security Bug Bounty program. According to the official announcement, the midpoint of reward ranges for medium, high, and critical findings has been more than quadrupled on average. A critical vulnerability in a core product such as ChatGPT, Codex, or the API Platform will now earn up to $30,000. Exceptional critical findings on those targets remain eligible for up to $100,000, and now up to $172,000 with bonuses.
In addition to base reward increases, OpenAI introduced new incentive structures to encourage high-quality reports. These include a "high-quality report bonus multiplier" for submissions that provide a reliable proof of concept, isolate the bug, and demonstrate its impact; and a five-tier "loyalty program bonus" designed to support researchers who consistently partner with the company. Furthermore, "priority campaign multipliers" will offer short-term high-reward opportunities for early testing of newly launched features.
OpenAI stated that these updates are designed to further encourage independent researchers to pursue vulnerabilities that internal testing may have missed, continuing to build a collaborative, community-first security environment. The company also noted that retroactive payments will be made for bounties awarded in the 30 days before this announcement if the finding would have earned more under the new ranges. This move reflects the growing importance of frontier AI models in cybersecurity and a strategic shift towards using economic means to accelerate external defensive participation.