·
·
Thursday, 5 November 2026dailybeirut.com
AI
OpenAI has significantly increased its bug bounty rewards, offering up to $172,000 for exceptional cases involving critical vulnerabilities in ChatGPT and other products.
OpenAI has substantially raised the financial incentives offered to security researchers who identify vulnerabilities within its ecosystem. The updated program now allows for total rewards reaching approximately $172,000 in exceptional circumstances when additional bonuses are factored in. This revision applies to reports concerning ChatGPT, Codex, and the company’s API platform.
According to an announcement published on OpenAI’s official website, the average mid-range payouts for medium, high, and critical severity bugs have increased by more than four times. For certain critical vulnerabilities in flagship products, the base reward can now reach $30,000. In exceptional cases, researchers may qualify for a base payment of up to $100,000 before any additional incentives are applied.
The scale of the reward is tied directly to the quality of the submission rather than the mere discovery of an issue. OpenAI grants extra bonuses to reports that include practical proof-of-concept evidence demonstrating exploitability. These submissions must also clearly outline the conditions required for the vulnerability to occur and detail the resulting impact.
To further encourage ongoing collaboration, the company has launched a five-tier loyalty system for consistent contributors. Additionally, specific campaigns are designed to test new features during their early launch phases.
The new compensation ranges will apply retroactively to previously submitted reports that have not yet been paid out. OpenAI stated it would pay the difference in rewards to some researchers who received prizes within the 30 days preceding the announcement.
This adjustment aims to expand the role of independent researchers in identifying problems before they are exploited. However, the company emphasizes a distinction between base reward limits and amounts achievable only through meeting bonus criteria. Consequently, not every discoverer of a critical flaw automatically receives the maximum announced figure.
