OpenAI bug bounty rewards just went up. In a November 2, 2026 blog post, OpenAI said the midpoints of its medium, high and critical reward ranges more than quadrupled on average. A critical vulnerability in a core product such as ChatGPT, Codex or the API Platform now earns up to $30,000 at the base rate. Exceptional critical findings remain eligible for up to $100,000, and up to about $172,000 with bonuses.
The announcement is titled “Rewarding defenders with bigger bug bounties”. The program runs on Bugcrowd; Help Net Security summarized the raise on November 3. Here is what changed, how the multipliers work and what is still open.
OpenAI bug bounty: new base ranges
OpenAI says independent researchers remain essential for catching issues internal testing misses. The bug bounty sits alongside the company’s Defense Factory, where engineers use OpenAI models to find weaknesses, reproduce them and test fixes. The message is that external and internal review should reinforce each other, not replace one another.
From the blog:
- Midpoints for medium, high and critical ranges: more than quadrupled on average
- Critical flaw in core products (ChatGPT, Codex, API Platform): base up to $30,000
- Exceptional critical findings: base still up to $100,000
- With quality, loyalty and priority-campaign bonuses: up to about $172,000
Those figures come from OpenAI’s own examples; the live range table lives in the Bugcrowd program and can shift with campaigns. Anyone submitting should check the live spans and in-scope targets there — not only the blog post.
Quality, loyalty and campaign multipliers
Three bonus layers stand out and can multiply the base award:
- Quality bonus: Reports with a reliable proof of concept, clear isolation of the bug and demonstrated impact can earn a multiplier. OpenAI’s examples use about 1.15×. The post stresses that a strong PoC gives engineers a head start on a fix.
- Loyalty program: Five tiers reward researchers who keep coming back. The examples mention Bronze (1.05), Gold (1.10) and a top “31337” tier (1.15).
- Priority campaigns: Short runs with dedicated pools for newly launched features; the sample multiplier goes up to 1.30×.
All payout examples are labeled illustrative. A medium ChatGPT (core) case — a read-only member uploading files to a Project without write permission — moves from a historical $750 to about $2,415 ($2,000 × 1.15 × 1.05). A high IDOR on a non-core asset (Prism) rises from $1,000 to roughly $3,162.50. A critical one-click account-takeover example on ChatGPT rises from $6,500 to roughly $51,577. An exceptional boundary-compromise example (for instance the ability to view arbitrary users’ chat messages) lands at $171,925 — the source of the widely quoted “$172,000” figure.
Important: historical awards and the new calculations are examples, not a guarantee for every report. Severity, asset class and report quality still drive the actual payout.
Retroactive payments and scope
Reports still waiting for a bounty get the new ranges. For awards paid in the 30 days before the announcement, OpenAI will top up the difference if the finding would have earned more under the new rules. The post explicitly says “Base Award + Loyalty Awards” — quality and campaign multipliers are not fully included in that top-up language.
As with many AI product programs, model behavior such as jailbreaks and hallucinations is often out of scope unless a separate product flaw is involved. Researchers should check live in-scope targets on Bugcrowd; they shift with product launches and campaigns.
OpenAI’s security team also plans to be at PROMPT2PWN in Oakland on November 20–21 and invites researchers to test targets in person.
Context: a signal, not a silver bullet
Higher bounties signal that OpenAI wants more external pressure on ChatGPT, Codex and the API. The program still complements internal work rather than replacing it — the same pattern many vendors use with bounties plus red teams. A price raise alone does not close architecture gaps; it changes the incentive to report findings responsibly instead of selling them quietly or dropping them without coordination.
On code404zero we have covered related tensions before: Google pausing its open-source bug bounty amid AI spam, the debate around GPT-6 Astra and cybersecurity thresholds, and OpenAI’s four-layer misalignment monitoring. The earlier Medicare portal incident involving an OpenAI agent is another reminder that product security and agent risk need separate treatment.
Defense Factory and industry trend
OpenAI explicitly ties the bounty raise to the Defense Factory: internal teams use the company’s own models to find weaknesses and verify fixes. Higher external rewards are meant to reinforce that same defensive line from the outside. The blog frames this as part of a “community-first” security model — aiming for researchers who return, not one-off payouts.
Industry-wide the direction is familiar, but the jump is large: more than quadrupling midpoints for medium through critical is a strong price signal. Whether that yields more high-quality reports or mostly noisier low-quality submissions depends on triage and the quality multipliers. That is why OpenAI stresses PoC quality — weak reports should pay less.
What remains open
The blog does not publish a full new price table or statistics on past payouts or turnaround times. Whether loyalty tiers are publicly auditable and how often priority campaigns run will show up on the Bugcrowd engagement. It is also unclear how strongly the raise will shift report volume and quality — that takes months of practice.
For teams that ship OpenAI APIs and agents, the bounty raise does not change hardening duties: auth, secrets, least privilege, logging and monitoring still matter. For security researchers the incentive is clearer: well-documented findings on core products pay more — including top-ups for recently scored reports. Anyone submitting should read the Bugcrowd rules, stay in scope and avoid stressing live systems outside allowed targets.
