OpenAI lifts critical bug-bounty base-award ceiling to $30,000 and adds bonuses

OpenAI raised its Security Bug Bounty reward ranges, setting a base award of up to $30,000 for a qualifying critical vulnerability in a core product such as ChatGPT, Codex, or its API Platform and adding three types of researcher bonuses.

The company said the average midpoint of its reward ranges for medium-, high-, and critical-severity findings is now more than four times the previous midpoint. Exceptional critical findings on those core targets remain eligible for base awards of as much as $100,000; OpenAI’s highest worked example reaches $171,925 after bonuses. Those figures describe OpenAI’s program and illustrative calculations, not independently measured security gains.

One new multiplier rewards report quality. OpenAI said an eligible report should include a reliable proof of concept that isolates the bug and shows the conditions needed to exploit it and its impact. A five-tier loyalty program adds scaling bonuses for repeat participants, while short-term priority campaigns for newly launched features will draw from dedicated bonus pools.

OpenAI’s examples apply a 1.15 quality multiplier, loyalty multipliers ranging from 1.05 to 1.15, and a 1.30 priority-campaign multiplier. In one critical ChatGPT scenario, those multipliers lift a $30,000 base award to $51,577. In an exceptional scenario, they lift a $100,000 base award to $171,925. The company labels every scenario and historical award in the table illustrative, so the examples do not establish that each multiplier is available for every report.

The new ranges also apply to submitted reports that have not yet received an award, OpenAI said. For awards made in the 30 days before the announcement, the company said it will pay the difference when the new base and loyalty awards would have produced a higher payout.