OpenAI Raises Security Bug Bounty Rewards, Adds Researcher Bonuses
OpenAI's update raises the midpoint of its medium, high, and critical bug-bounty reward ranges by more than four times on average and adds report-quality, loyalty, and priority-campaign bonuses. A critical finding in a core product can receive up to $30,000 as a base bounty; exceptional critical findings remain eligible for up to $100,000 as a base award or up to $172,000 with bonuses. New ranges apply to submitted reports that have not yet received a bounty, and some awards from the prior 30 days qualify for a difference payment.
OpenAI is increasing rewards in its Security Bug Bounty program and adding new incentives for independent security researchers. The update says the midpoint of reward ranges for medium, high, and critical findings is rising by more than four times on average, with new bonuses for report quality, researcher loyalty, and priority campaigns. (OpenAI's announcement)
The change is directed at researchers who responsibly disclose vulnerabilities in OpenAI software. It updates the program's rewards rather than changing a user-facing ChatGPT feature. (OpenAI)
Base awards and bonus-adjusted totals
OpenAI says a critical finding in a core product such as ChatGPT, Codex, or the API Platform can receive up to $30,000 as a base bounty. Exceptional critical findings on those products remain eligible for up to $100,000 as a base award, with the announcement listing up to $172,000 when bonuses are included. (OpenAI)
The bonus examples show how totals can exceed base awards. OpenAI's illustrative table raises a $30,000 base bounty to $51,577 with quality, priority-campaign, and loyalty multipliers; an exceptional example raises a $100,000 base award to $171,925. The page says all scenarios and historical awards are illustrative. (OpenAI)
Three new bonus paths
The update adds a quality multiplier for reports that clearly establish a finding and its impact. OpenAI also says it is introducing a five-tier loyalty program for researchers who consistently work with the company. The announcement does not list the loyalty-tier thresholds or a complete multiplier table; its illustrative examples show 1.15x for quality, 1.30x for a priority campaign, and 1.05x, 1.10x, and 1.15x for the Bronze, Gold, and 31337 loyalty tiers. (OpenAI)
Priority campaigns for newly launched features will have dedicated bonus pools. OpenAI describes them as short-term opportunities to test new developments and receive recognition for early contributions. (OpenAI)
Earlier submissions can qualify
The new reward ranges apply to reports that have already been submitted if OpenAI has not yet awarded a bounty. OpenAI also says it will pay the difference for qualifying bounties awarded in the 30 days before the announcement when the finding would have earned more under the new ranges. The comparison includes the base award and loyalty awards. (OpenAI)
Researchers should review the current Security Bug Bounty rules, including any priority-campaign terms, before testing or submitting a report; the update does not say that it changes what is in scope. (OpenAI)
Read next
Related coverage- OpenAI
OpenAI Brings Codex Security Review to GitHub Pull Requests
Codex Security Review is OpenAI’s research-preview workflow for deeper security analysis of GitHub pull requests. It uses the diff, repository context, and optional threat-model guidance, then reports actionable findings in the pull request and a fuller report in Codex. Enterprise, Business, Edu, and Pro users can configure it; Plus is excluded.
- OpenAI
OpenAI Shares a Defense Factory Playbook for Agentic Cyber Defense
OpenAI is sharing a Defense Factory playbook that connects security tools, skills, reproducible environments, and agents into a continuous loop for discovering, validating, assigning, remediating, and independently verifying vulnerabilities.
- OpenAI
OpenAI Releases Codex Security CLI for Repository Scans and CI Checks
OpenAI says its open-source Codex Security CLI can scan repositories, track findings across runs, verify fixes, and add security checks to CI/CD. The beta CLI requires Codex Security access and is built for teams that want code-aware security review in the terminal.
- OpenAI
OpenAI Shares a PHP Version Checker and Codex Skills
OpenAI has published a PHP Version Checker repository with Codex skills for identifying PHP versions that may need security updates. The checker reads the version a website advertises in its headers or a local PHP installation reports and compares it with the upstream fixed releases from the October 21, 2026 PHP advisory. It is a triage aid, not proof that a system is patched or secure.
Sources
- OpenAI, Rewarding defenders with bigger bug bounties, November 2, 2026
Frequently Asked Questions
What changed in OpenAI's Security Bug Bounty program?
OpenAI says the midpoint of its medium, high, and critical reward ranges is increasing by more than four times on average. It is also adding report-quality, loyalty, and priority-campaign bonuses.
What is the maximum reward OpenAI lists?
A critical finding in a core product such as ChatGPT, Codex, or the API Platform can receive up to $30,000 as a base bounty. Exceptional critical findings on those targets remain eligible for up to $100,000 as a base award, or up to $172,000 with bonuses.
Do the new reward ranges apply to earlier reports?
OpenAI says the new ranges apply to reports already submitted if it has not yet awarded a bounty. For awards made in the 30 days before the announcement, it will pay the difference if the finding would have earned more under the new ranges.
Who is the program for?
OpenAI says the Security Bug Bounty program encourages independent researchers to pursue vulnerabilities in OpenAI software that its testing may have missed.