OpenAI Raises Security Bug Bounty Rewards and Adds Tiered Multipliers

On November 2, 2026, OpenAI announced updates to its Security Bug Bounty program to encourage independent security researchers to find vulnerabilities in its software. The organization stated that the midpoint of its reward ranges for medium, high, and critical findings has been more than quadrupled on average. Under the updated structure, critical vulnerabilities in core targets such as ChatGPT, Codex, or the API Platform can earn up to $30,000, while exceptional critical findings remain eligible for up to $100,000 and can reach up to $172,000 with bonuses. Alongside higher base bounties, OpenAI introduced bonus multipliers: a quality multiplier for clear proofs of concept, a 5-tier loyalty program for regular contributors, and priority campaign pools for newly released features. The new ranges apply to unawarded pending submissions and retroactively cover bounties awarded in the 30 days before the announcement.

Key takeaways

• OpenAI more than quadrupled the average midpoint of its reward ranges for medium, high, and critical vulnerability findings.
• Critical findings on core targets such as ChatGPT, Codex, or the API Platform now earn up to $30,000, while exceptional critical findings can reach up to $172,000 with bonuses.
• New bonus incentives include multipliers for report quality, a 5-tier loyalty bonus program, and dedicated bonus pools for priority campaigns on new features.
• The updated payout scale applies to pending unawarded reports and retroactively compensates qualifying bounties awarded in the 30 days prior to the announcement.