OpenAI Raises Bug Bounty Payouts, With Stacking Bonuses Up to $172,000

OpenAI said on November 2 that it is substantially increasing payouts in its Security Bug Bounty program, raising the midpoint of its reward ranges for medium, high and critical findings by more than four times on average. The company also introduced three new bonus mechanisms — a report-quality multiplier, a five-tier loyalty program and time-limited campaign multipliers — that stack on top of the base award and can push an exceptional critical finding to roughly $172,000. For security teams that compete for the same small pool of researchers, the announcement is as much a pricing signal as a security one.

What actually changed

The headline number is the ceiling. According to OpenAI, a critical vulnerability in what it calls a core product — ChatGPT, Codex or the API Platform — will now earn up to $30,000 at base. Findings the company classifies as "exceptional critical" on those same targets remain eligible for up to $100,000, and can reach up to $172,000 once bonuses are applied. OpenAI did not publish the full revised range table in the announcement itself, pointing instead to its program page for details.

The more informative part is the worked examples OpenAI provided, which contrast illustrative historical awards against the new math. A medium-severity ChatGPT issue — a read-only project member able to upload files without write permission — is shown moving from an example historical award of $750 to a $2,000 base, multiplied by a 1.15 quality bonus and a 1.05 bronze loyalty bonus, for $2,415. A high-severity insecure direct object reference on a non-core asset the company calls Prism goes from $1,000 to $3,162.50. A one-click ChatGPT account takeover moves from $6,500 to $51,577 once a 1.15 quality bonus, a 1.30 priority campaign bonus and a 1.15 top-tier loyalty bonus are applied to the $30,000 base. OpenAI labeled all of these scenarios and the historical figures as illustrative, which is worth taking literally: they are not a disclosure of what the company has typically paid.

The multipliers compound rather than add. In the top example, three bonuses turn $100,000 into $171,925. That design rewards researchers who do several things at once — submit during a campaign window, have accumulated loyalty tier status, and package the report well — rather than simply finding something severe.

The bonus structure, and what wasn't disclosed

OpenAI describes the quality multiplier as recognition for reports that include a reliable proof of concept isolating the bug, showing the conditions under which it can be exploited and demonstrating impact. The rationale is practical: a reproducible PoC shortens triage and gives the engineering team a head start on a fix. Every example in the announcement uses a 1.15 quality multiplier, but OpenAI did not say whether that is the maximum, the only tier, or a midpoint, nor did it describe how quality will be judged or appealed. In bounty programs, subjective quality grading is a recurring source of friction between researchers and triage teams.

The loyalty program is described as five tiers with scaling bonuses for researchers who report consistently over time. Three tier names appear in the examples — bronze at 1.05, gold at 1.10 and a top tier labeled "31337" at 1.15 — but the full ladder, the criteria for advancement and whether tiers decay were not disclosed. Priority campaigns, meanwhile, will carry dedicated bonus pools aimed at newly launched features, giving researchers a short, higher-reward window to probe fresh code. That is a sensible allocation of attention, since new surface area is where bugs cluster, but it also means the incentive to test mature, less glamorous systems stays comparatively flat.

OpenAI said the new ranges will be applied retroactively in two ways: reports already submitted but not yet awarded will be paid under the new ranges, and for bounties awarded in the 30 days before the announcement, the company will pay the difference if the finding would have earned more — limited to base award plus loyalty awards. Researchers paid 31 days earlier get nothing extra. The company also said its security team will be at PROMPT2PWN in Oakland on November 20–21, where researchers can test targets in person.

Reading the example vulnerabilities

The four scenarios OpenAI chose are all conventional application security problems: a permissions bypass, an IDOR, an account takeover and a cross-tenant data exposure described as the ability to view arbitrary users' chat messages. None of the published examples involve model behavior — prompt injection, jailbreaks, tool-use abuse in agentic systems or training data extraction. The announcement does not state whether those categories are in or out of scope, and the program page was not reproduced in the post, so the omission should not be read as exclusion. But it does suggest the price increase is aimed squarely at the parts of OpenAI's stack that look like any other large SaaS product.

That matters because the hardest unsolved security problems in AI products sit on the model side, where severity is notoriously difficult to classify and where a "fix" may be a mitigation with a measurable failure rate rather than a patch. Bounty programs are built on reproducible, binary bugs. Extending the same economics to probabilistic systems is a genuinely open problem across the industry, and this announcement does not claim to solve it.

OpenAI framed the external program as a complement to what it calls Defense Factory, internal work in which its engineers use the company's own models to find weaknesses, reproduce them and test fixes. The implicit argument is that automated internal discovery raises the floor, and higher bounties are needed to keep human researchers interested in the bugs that automation misses. The company did not release figures on how many vulnerabilities Defense Factory has surfaced, how its output compares with external reports, or how many reports the bounty program receives and pays out annually.

Why the raise, and what it costs

There is a straightforward market reason to raise rewards: offensive buyers pay more. Exploit brokers have long outbid vendor programs for high-impact vulnerabilities in widely deployed software, and AI platforms that sit on top of corporate credentials, code repositories and private conversations are becoming attractive targets. Pushing a critical account takeover from a five-figure to a low-six-figure outcome narrows that gap without closing it.

The risk in any multiplier-heavy design is complexity. Researchers generally respond to clear, predictable payouts; a scheme with three stacking bonuses, an unpublished tier ladder and a subjective quality grade makes expected value harder to compute before committing time to a target. Whether the increase produces more useful reports — as opposed to more reports — will not be visible from the announcement. The cleanest signal would be aggregate data a year from now on volume, median payout and time to fix, none of which OpenAI has committed to publishing.

What to watch

• Whether OpenAI publishes the full loyalty tier criteria, quality multiplier rubric and campaign schedule, or keeps them discretionary.
• Whether model-layer issues such as prompt injection and agentic tool abuse get their own severity rubric and reward ranges, or stay outside the classic application security framing used in the examples.
• Whether rival AI vendors match the increase; bounty pricing tends to move as a market, and a single large raise often resets expectations across the sector.
• Actual median payouts versus the advertised ceilings. "Up to $172,000" requires three stacked bonuses and a top loyalty tier, which few researchers will hit.
• Any disclosure tying Defense Factory's automated findings to external report volume, which would indicate whether internal AI-driven discovery is displacing or redirecting human research effort.