OpenAI Security Bug Bounty Program Updates

Increased Reward Structures

OpenAI has increased the midpoint of its reward ranges for medium, high, and critical vulnerability findings by more than four times on average. Critical vulnerabilities found in core products such as ChatGPT, Codex, or the API Platform are now eligible for base rewards of up to $30,000. Exceptional critical findings remain eligible for up to $100,000, with the potential to reach $172,000 when combined with new bonus multipliers.

New Incentive Multipliers

To improve the quality of submissions and foster long-term collaboration, OpenAI has introduced three new categories of bonus multipliers:

  • High-Quality Report Bonuses: Researchers providing reliable proof-of-concept code that isolates the bug, demonstrates exploitability, and defines the impact are eligible for a base bounty multiplier.
  • Loyalty Program Bonuses: A new 5-tier loyalty system provides scaling bonuses for researchers who consistently contribute to the program.
  • Priority Campaign Multipliers: Dedicated bonus pools are now available for short-term campaigns focused on newly launched features, encouraging early testing of new developments.

Retroactive Payment Policy

OpenAI has implemented a retroactive policy for recent and pending submissions. Reports that have been submitted but not yet awarded will be evaluated under the new reward ranges. Furthermore, researchers who received a bounty in the 30 days prior to the November 2, 2026 announcement are eligible to receive the difference if the new calculation (Base Award plus applicable Loyalty Awards) would have resulted in a higher payout.

Community Engagement

OpenAI continues to integrate independent researcher feedback into its broader security strategy, which includes the "Defense Factory"—an internal initiative where engineers use AI models to identify, reproduce, and patch vulnerabilities. As part of its commitment to community engagement, the OpenAI security team will attend the PROMPT2PWN event in Oakland on November 20–21, 2026, to facilitate in-person collaboration and testing.

Sources