Editorial illustration for OpenAI raises bug bounty payouts to USD 172,000, matching Google rates
OpenAI Quadruples Bug Bounty to $172,000
OpenAI just made it a lot more lucrative to break its own products on purpose. The company announced it's quadrupling its bug bounty payouts, with critical vulnerabilities in core tools like ChatGPT or Codex now earning outside researchers up to $30,000. Exceptional discoveries can bring in up to $100,000 on their own, and once quality, loyalty, and campaign bonuses stack on top, a single report can net close to $172,000.
That figure puts OpenAI roughly on par with Google's general vulnerability rewards program, even if it still trails what Apple or Microsoft pay out for OS-level exploits. The overhaul also adds a five-tier loyalty program for repeat researchers and time-limited campaigns that pay extra when new features launch. Anyone who flagged a vulnerability in the past 30 days will get backdated pay to match the new rates.
The timing isn't incidental. OpenAI is also gearing up for an internal security sprint, pairing its own engineers with an outside security firm to hunt for weaknesses before anyone else does. How the company structures that effort says a lot about where it thinks the real risks are sitting right now.
OpenAI quadruples bug bounty payouts and launches new internal security sprint. Critical vulnerabilities in core products like ChatGPT or Codex now earn outside researchers up to $30,000, the company announced. Exceptional findings can net up to $100,000, and with quality, loyalty, and campaign bonuses, the total can reach roughly $172,000.
Why this matters
For researchers deciding where to spend their time, this is a straightforward signal: OpenAI's attack surface is now worth probing at Google-level rates, which should pull more serious talent toward testing ChatGPT and Codex rather than treating them as side projects. For founders building on OpenAI's APIs, the raise is a reminder that the company sees real risk in its core products, enough to pay $100,000 for a single exceptional find and stack bonuses on top. That's not charity; it's pricing in the cost of what a bad exploit in a widely embedded model could do downstream.
Still worth noting what the numbers don't say: $172,000 trails what Apple and Microsoft pay for OS-level exploits, which tells you where OpenAI ranks its own stack against operating systems in terms of blast radius, at least in its own accounting. Developers leaning on these tools daily should read the bounty increase less as a trust signal and more as a data point on where OpenAI thinks its weak spots sit.
Related Reading
Browse all OpenAI news →
Business & Startups Nordic pilot adds Gemini for Education, NotebookLM to boost AI literacy
Business & Startups Kling launches Video O1, all-in-one model with MVL bridge using transformer
Business & Startups DeepSeek Seeks More Capital Weeks After USD 7B Funding Round
Related Topic OpenAI researcher quits, citing distrust over ad‑driven engagement metrics
LLMs & Generative AI
Related Topic OpenAI launches GPT-Image 1.5 with precise editing for enterprise visuals
LLMs & Generative AI
From Archives Coforge BridgeCX Connects Pega, Mastercard, Dynamic Yield for Personalisation
From Archives Madrid Digital Builds Resident Agents With 1MillionBot and NVIDIA Nemotron
From Archives OpenAI pitches data center power plants as protectors amid US opposition
From Archives OpenAI Signs Four Abu Dhabi Agreements Across Government, Energy and Investment
Common Questions Answered
How much can security researchers earn for finding critical vulnerabilities in ChatGPT or Codex?
Security researchers can earn up to $30,000 for critical vulnerabilities in core OpenAI products like ChatGPT or Codex. Exceptional discoveries can bring in up to $100,000 on their own, and when quality, loyalty, and campaign bonuses are stacked together, a single report can net close to $172,000 total.
How does OpenAI's new bug bounty payout compare to Google's rates?
OpenAI's maximum bug bounty payout of approximately $172,000 now puts the company roughly on par with Google's general vulnerability bounty rates. This alignment signals that OpenAI's attack surface is now worth probing at the same level of compensation as one of the tech industry's largest companies.
What was the previous bug bounty structure before OpenAI quadrupled its payouts?
While the article doesn't specify the exact previous payout amounts, it indicates that OpenAI quadrupled its bug bounty payouts, meaning the new $30,000 for critical vulnerabilities and up to $172,000 total represents a four-fold increase from the company's previous bounty program.
Why is OpenAI significantly increasing its bug bounty program?
OpenAI is raising bug bounty payouts to attract more serious security talent to test its core products like ChatGPT and Codex, signaling that the company sees real risk in these tools and wants to proactively identify vulnerabilities. The substantial payouts demonstrate OpenAI's commitment to security and its willingness to invest in external researchers to strengthen its defenses.
Further Reading
- Rewarding defenders with bigger bug bounties - OpenAI
- OpenAI raises top bug bounty payout to $172,000 with bonuses - Help Net Security
- OpenAI Brings In Cathedral, Lifts Bug Bounty Cap to $172K - FourWeekMBA
- OpenAI teams up with Cathedral to find and fix AI flaws faster, boosts bug bounties - India Today
- A Shared ChatGPT Link Could Run Attacker Code in Your Logged-In Session - The Hacker News
