OpenAI announced changes to its Security Bug Bounty program on 2 November 2026. The company says the midpoint of its reward ranges for medium, high and critical findings has risen more than fourfold on average. This changes incentives for researchers; it does not establish that any specific product has a newly discovered flaw or that more vulnerabilities have been found.
What can researchers earn?
Under OpenAI’s announced ranges, a critical vulnerability in a core product such as ChatGPT, Codex or the API Platform can earn up to $30,000. Exceptional critical findings on those targets can reach $100,000 before applicable bonuses, or up to $172,000 with bonuses. The larger figure is a possible ceiling, not a standard payout. The announcement’s examples are illustrative, so no individual report is assured of those sums.
What changes in the calculation?
OpenAI describes three additional incentives. A report-quality multiplier can reward a reliable proof of concept that isolates a flaw, shows when it can be exploited and demonstrates its impact. A five-tier loyalty program provides bonuses for researchers who contribute consistently. Short-term priority campaigns feature dedicated bonus pools for newly launched features. Researchers should distinguish the base award from conditional bonuses when comparing headline figures.
Does this apply to earlier reports?
For reports submitted before the announcement, OpenAI says it will apply the new ranges if no bounty has yet been awarded. For bounties awarded in the preceding 30 days, it says it will pay the difference where the new base award plus loyalty award would have been higher. That does not mean every earlier report receives another payment.
The announcement links to the program on Bugcrowd for its complete terms. That engagement page displayed only a login screen during our check. Researchers should verify the current scope, eligibility, exclusions and permitted testing in the program before conducting research.
