- OpenAI quadrupled its bug bounty payouts, with exceptional findings in core products like ChatGPT and Codex now eligible for up to $172,000 once bonuses are included.
- Base payouts for critical vulnerabilities rose to $30,000, with exceptional findings reaching $100,000 before bonuses.
- A new five-tier loyalty program and time-limited campaigns offer boosted payouts tied to new feature launches.
- OpenAI is running a security sprint with firm Cathedral; in the last sprint, 25 percent of OpenAI’s product engineers worked on finding vulnerabilities.
What Happened
OpenAI has quadrupled its bug bounty payouts and launched a new internal security sprint (The Decoder, Nov. 3, 2026). Critical vulnerabilities in core products like ChatGPT or Codex now earn outside researchers up to $30,000, with exceptional findings worth up to $100,000 before bonuses.
Why It Matters
With quality, loyalty, and campaign bonuses, total payouts can now reach roughly $172,000, putting OpenAI in the same range as Google’s general vulnerability rewards program, though still below top-tier payouts Apple or Microsoft offer for OS-level exploits. The move comes as AI offensive security research accelerates, a trend tracked in recent research on AI offensive cyber capability.
Technical Details
OpenAI added a five-tier loyalty program and time-limited campaigns that boost payouts around new feature launches. Anyone who reported a vulnerability in the past 30 days will get the difference between old and new rates applied retroactively. OpenAI is also pairing with security firm Cathedral for a stress-test sprint; in the previous sprint, 25 percent of OpenAI’s product engineers worked on finding vulnerabilities.
Who’s Affected
Independent security researchers who report vulnerabilities in ChatGPT, Codex, and other OpenAI products gain higher financial incentives, including retroactively for recent reports. The change follows broader industry concern about AI security raised at events like the one covered in this year’s RSA Conference.
What’s Next
OpenAI’s security sprint with Cathedral continues, with internal engineers continuing to dedicate significant time to vulnerability hunting alongside external researchers. OpenAI has not disclosed a schedule for further bounty program changes.
