OpenAI is increasing rewards in its Security Bug Bounty program, with higher payouts for medium, high and critical findings and new bonuses for report quality, long-term participation and selected priority campaigns. The company says the changes aim to encourage independent researchers to identify vulnerabilities that its own testing may miss.
The midpoint of reward ranges for medium, high and critical findings is rising by more than fourfold on average. A critical vulnerability affecting a core product, such as ChatGPT, Codex or the API Platform, can now receive up to $30,000. Exceptional critical findings on those products remain eligible for up to $100,000 before bonuses, and could reach $172,000 with them.
Researchers may receive a quality multiplier for reports that include a reliable proof of concept, isolate the issue, explain how it can be exploited and demonstrate its impact. OpenAI is also introducing a five-tier loyalty program, with bonuses for researchers who work with the company consistently, and short-term priority campaigns offering dedicated bonus pools for newly launched features.
Illustrative examples show how the incentives can affect payouts. A medium-severity ChatGPT finding with a $2,000 base award could total $2,415 after quality and loyalty bonuses. An exceptional critical finding with a $100,000 base award could reach $171,925 after quality, campaign and loyalty multipliers. OpenAI notes that the examples and historical awards are illustrative.
The new reward ranges will apply to reports already submitted if a bounty has not yet been awarded. For bounties paid in the 30 days before the announcement, OpenAI says it will pay the difference if the finding would have earned more under the new ranges, including base and loyalty awards.
OpenAI’s security team is also scheduled to attend PROMPT2PWN in Oakland on November 20–21, where researchers will be able to test targets in person.
Sources: OpenAI News.