OpenAI is increasing payouts in its Security Bug Bounty program to attract more independent researchers and reward higher-quality vulnerability reports. The update is framed as a complement to the company’s internal Defense Factory work, where engineers use OpenAI models to find, reproduce, and test fixes for weaknesses.

Reward ranges are being significantly expanded: the midpoint of ranges for medium, high, and critical findings is more than quadrupled on average. A critical vulnerability in a core product such as ChatGPT, Codex, or the API Platform now earns up to $30,000. Exceptional critical findings on those targets remain eligible for up to $100,000, and can now reach $172,000 with bonuses applied. Full ranges are published in the program’s official security bug bounty page.

Beyond base amounts, OpenAI introduced several new incentive mechanisms. High-quality reports can earn a bonus multiplier on the base bounty: a reliable proof of concept that isolates the bug, shows when it is exploitable, and demonstrates impact qualifies for the multiplier. A new five-tier loyalty program provides scaling bonuses for researchers who consistently submit valid reports. Priority campaigns will offer dedicated bonus pools for newly launched features, giving early testers short-term, high-reward opportunities.

OpenAI is also applying the new ranges retroactively. Previously submitted reports that have not yet received a bounty will be evaluated under the new reward ranges. For bounties awarded within 30 days before the announcement, OpenAI will pay the difference if the finding would have earned more under the new structure, calculated as Base Award plus Loyalty Awards.

The security team will attend PROMPT2PWN in Oakland on November 20–21, where researchers can test targets in person. The article closes by inviting researchers to share their work and encourages them to report findings they believe OpenAI may have missed.