OpenAI announced on November 2, 2026 that it is raising rewards in its Security Bug Bounty program, the main OpenAI bug bounty for traditional security flaws, more than quadrupling the average midpoint of its reward ranges for medium, high and critical findings. The company is also preparing an internal security sprint with the security firm Cathedral. For outside researchers, the changes affect both new submissions and reports filed in the past month.
- OpenAI announced on November 2, 2026 that it is more than quadrupling the average midpoint of its payout ranges across medium-, high- and critical-severity findings.
- Critical bugs in core products such as ChatGPT, Codex or the API Platform now earn up to $30,000; exceptional findings reach $172,000 with bonuses.
- New quality multipliers, a 5-tier loyalty program and priority campaign pools can stack on the base reward.
- Researchers paid in the last 30 days get the difference retroactively, and unawarded reports use the new ranges.
- OpenAI is preparing an internal sprint with the security firm Cathedral, with no start date given.
OpenAI raises Security Bug Bounty rewards across medium, high and critical findings
In its announcement, OpenAI said it is raising rewards in the Security Bug Bounty program, the channel through which researchers earn a ChatGPT vulnerability reward or a payout for flaws in Codex and the API Platform. A bug bounty is a reward program that pays outside researchers for responsibly disclosed security vulnerabilities.
According to OpenAI, the midpoint of the ranges at those three severity levels is being more than quadrupled on average. The figure is an average, so individual findings will not all rise by the same factor.
OpenAI gives a clear reason for the increase. It wants to reward outside researchers for finding vulnerabilities that its own testing may have missed. The company presents the bounty as one part of a wider push to make vulnerability detection continuous, alongside internal sprints and model-assisted testing, rather than something that happens only before a product launch.
A critical vulnerability in a core product such as ChatGPT, Codex or the API Platform will now earn up to $30,000. That is the base. Exceptional critical findings on core targets remain eligible for up to $100,000, and up to $172,000 once bonuses are included. ChatGPT itself keeps changing as a target, with its chat and work modes now drawing on a shared ChatGPT token budget.
Sources differ slightly on how they describe that top figure. The Decoder calls the total roughly $172,000, while OpenAI itself says $172,000 with bonuses. OpenAI’s own worked example for an exceptional ChatGPT finding comes to $171,925.
The $30,000 and $100,000 figures are the same in both The Decoder’s report and OpenAI’s post.
How bonuses stack on top of the base reward
The higher ceilings in the OpenAI bug bounty come from the base reward plus three kinds of bonus. Each is applied as a multiplier, and OpenAI’s examples show several of them combined on a single report.
Quality bonus and proof of concept
High-quality reports will earn a bonus multiplier on the base bounty. OpenAI singles out the reliable proof of concept: a demonstration that isolates the bug, shows when it can be exploited and proves its impact.
Such a demonstration gives OpenAI a head start on a fix, which is why the company rewards it. The company’s examples apply a 1.15 quality multiplier.
Loyalty tiers and priority campaigns
OpenAI is introducing a 5-tier loyalty bonus program that scales bonuses for researchers who consistently partner with it. The examples name Bronze and Gold tiers and a tier called 31337, with multipliers of 1.05, 1.10 and 1.15 respectively.
Priority campaigns add a third lever. They carry dedicated bonus pools for newly launched features and run as short-term campaigns. In one example, a priority campaign multiplier of 1.30 applies.
Because the multipliers stack, a researcher who reports regularly and files well-documented bugs against a featured product can earn noticeably more than the base range alone suggests.
OpenAI’s worked examples show old and new payouts side by side
OpenAI published four scenarios in its announcement comparing what a finding would historically have paid with the vulnerability reward it earns now. The calculations in the table below are quoted from that post. The company says all scenarios and historical awards in them are illustrative.
| Scenario | Historical award | New award | Calculation given |
|---|---|---|---|
| Medium ChatGPT (core asset): read-only member upload to a Project | $750 | $2,415 | $2,000 × 1.15 Quality Bonus × 1.05 Bronze Loyalty Tier Bonus |
| High-severity Prism (non-core asset) IDOR | $1,000 | $3,162.50 | $2,500 × 1.15 Quality Bonus × 1.10 Gold Loyalty Tier Bonus |
| Critical ChatGPT one-click account takeover | $6,500 | $51,577 | $30,000 × 1.15 Quality × 1.30 Priority Campaign × 1.15 31337 Loyalty Tier Bonus |
| Exceptional ChatGPT finding (significant compromise of a security boundary) | $100,000 | $171,925 | Not broken down in the list |
IDOR stands for insecure direct object reference, a flaw that lets a user access another user’s data by changing an identifier. It appears here as a finding type on Prism, which OpenAI classes as a non-core asset.
The largest jump is in the critical account-takeover case, which rises from $6,500 to $51,577. The medium and high examples show smaller absolute gains, but each is roughly threefold.
In the exceptional case the relative change is smallest, from $100,000 to $171,925. Note that the critical example reaches its figure only with all three multipliers applied; the base for such a bug is $30,000.
Researchers with recent reports are paid the difference
Anyone who reported a vulnerability to the OpenAI bug bounty in the last 30 days receives the difference between the old and new rates retroactively, according to both OpenAI and The Decoder.
OpenAI spells out the mechanics. For bounties awarded in the 30 days before the announcement, it will pay the difference if the finding would have earned more under the new ranges, counting the Base Award plus Loyalty Awards.
Reports that have been submitted but not yet awarded are handled more simply: OpenAI will apply the new reward ranges to them directly.
The sources do not say whether researchers need to take any action to claim the difference, or how and when the payments will be made.
The internal security sprint with Cathedral
Alongside the payout changes, OpenAI is preparing a security sprint in which Cathedral Systems, a security startup, will team up with OpenAI’s engineers to stress-test its systems, according to The Decoder. Cathedral’s researchers will use OpenAI’s models to challenge the company’s own defenses. News reports describe the firm as founded by former staff of the Department of Government Efficiency (DOGE).
Cathedral’s chief executive, Gavin Kliger, described the collaboration as combining his team’s research with OpenAI’s models. The firm’s track record is contested. According to several reports, Anthropic later accused Cathedral of withholding information and breaking the rules of its bug bounty, which puts testing boundaries and disclosure at the center of this engagement. OpenAI frames the sprint as a step toward making model-assisted vulnerability research an ongoing operation rather than a one-off exercise.
The company says that during its last sprint, a large share of its product engineers worked on finding vulnerabilities. That claim comes from OpenAI and gives a sense of the scale of such efforts.
OpenAI also describes Defense Factory work, which uses its engineers and models to find weaknesses, reproduce them and test fixes.
No start date for the Cathedral sprint is given in the sources. Details such as its length, scope or how many engineers will take part have not been published.
How this fits OpenAI’s other bounty programs
The Security Bug Bounty is one of several OpenAI bug bounty programs. It has operated since April 2023 on Bugcrowd and covers traditional application security vulnerabilities, the category the new ranges apply to.
On March 25, 2026, OpenAI launched a separate Safety Bug Bounty aimed at agentic AI risks such as prompt injection, data exfiltration and autonomous actions, as described by digitalapplied.com. Prompt injection means attacker-controlled text that hijacks an AI agent’s behavior.
The Safety Bug Bounty covers ChatGPT Agent, Browser and similar agentic products and is also hosted on Bugcrowd.
Scope limits in the Safety Bug Bounty
Simple jailbreaks and general content-policy bypasses are out of scope unless they show demonstrable safety or abuse impact. Prompt injection findings must be reliably reproducible across test runs, meeting a minimum success rate the program sets.
The Safety program also covers account and platform integrity, meaning ways to get around the safeguards that stop accounts or the platform from being abused at scale. If a report lands in the wrong program, OpenAI’s triage team can reroute it between the Security and Safety bounties, so researchers do not lose a valid finding over the choice of program.
The GPT-5.5 Bio Bounty
OpenAI also ran a GPT-5.5 Bio Bounty. Per its program page, it offered $25,000 for the first universal jailbreak that cleared five bio safety questions in Codex Desktop, with applications opening April 23, 2026.
| Program | Target | Platform | Launch or date | Scope |
|---|---|---|---|---|
| Security Bug Bounty | Traditional application security vulnerabilities | Bugcrowd | Since April 2023 | Core products such as ChatGPT, Codex and the API Platform, plus non-core assets such as Prism |
| Safety Bug Bounty | Agentic AI risks | Bugcrowd | March 25, 2026 | ChatGPT Agent, Browser and similar agentic products, including prompt injection, data exfiltration and autonomous actions |
| GPT-5.5 Bio Bounty | A specific model-safety challenge | OpenAI program page | Applications opened April 23, 2026 | First universal jailbreak that clears five bio safety questions in Codex Desktop |
Together, the three programs split the work by target: classic application flaws, agent behavior, and a specific model-safety challenge.
How the new payouts compare with other tech companies
The Decoder reports that Google’s general vulnerability rewards program pays in a similar range to the OpenAI bug bounty. Apple and Microsoft offer higher top-tier payouts for OS-level exploits.
The sources do not give figures for those companies, so the comparison can’t go further than that.
PROMPT2PWN in Oakland is the next chance to test targets in person
OpenAI’s security team will attend PROMPT2PWN in Oakland on November 20 to 21, 2026, according to the company. Researchers can test targets in person at the event.
The pages do not specify which targets will be available or whether event findings fall under the new OpenAI bug bounty reward ranges.
Sources
- The Decoder, Bug hunters can now earn up to $172,000 from OpenAI as company ramps up security
- OpenAI, Rewarding defenders with bigger bug bounties
- OpenAI, GPT-5.5 Safety Bio Bounty Program
- digitalapplied.com, OpenAI Safety Bug Bounty and AI agent security guide
Photo by The Decoder
Frequently asked questions
How much does the OpenAI Security Bug Bounty pay now?
How much does the OpenAI Security Bug Bounty pay now?
A critical vulnerability in a core product such as ChatGPT, Codex or the API Platform earns up to $30,000. Exceptional critical findings on core targets can reach $100,000, and up to $172,000 with bonuses.
Does the ChatGPT bug bounty cover older reports?
Does the ChatGPT bug bounty cover older reports?
Partly. Anyone who reported a vulnerability in the last 30 days receives the difference between the old and new rates, and reports not yet awarded use the new ranges.
What is the difference between the Security Bug Bounty and the Safety Bug Bounty?
What is the difference between the Security Bug Bounty and the Safety Bug Bounty?
The Security Bug Bounty, running since April 2023, covers traditional application security vulnerabilities. The Safety Bug Bounty, launched March 25, 2026, targets agentic AI risks such as prompt injection, data exfiltration and autonomous actions.
What was the GPT-5.5 Bio Bounty?
What was the GPT-5.5 Bio Bounty?
It offered $25,000 for the first universal jailbreak that cleared five bio safety questions in Codex Desktop. Applications opened April 23, 2026.
What counts as a high-quality report?
What counts as a high-quality report?
OpenAI points to a reliable proof of concept that isolates the bug, shows when it can be exploited and demonstrates impact. Such reports earn a bonus multiplier on the base bounty.
Where can researchers meet OpenAI’s security team?
Where can researchers meet OpenAI’s security team?
At PROMPT2PWN in Oakland on November 20 to 21, 2026, where researchers can test targets in person.