From the source
OpenAI is raising payouts in its Security Bug Bounty program and adding bonus multipliers, saying it wants independent researchers to pursue vulnerabilities its own testing may have missed.
- The company says it is more than quadrupling the midpoint of its reward ranges for medium, high and critical findings on average.
- A critical vulnerability in a core product such as ChatGPT, Codex or the API Platform will now earn up to $30,000, while exceptional critical findings on those targets remain eligible for up to $100,000 and now up to $172,000 with bonuses.
- High-quality reports can earn a multiplier on the base bounty when they include a reliable proof of concept that isolates the bug, shows when it can be exploited and demonstrates its impact.
- OpenAI is also introducing a 5-tier loyalty bonus program and priority campaigns with dedicated bonus pools for newly launched features.
- Reports already submitted but not yet awarded will be judged under the new ranges, and bounties paid in the 30 days before the announcement will be topped up if the finding would have earned more.
