OpenAI increased its security bug bounties to encourage independent researchers to find vulnerabilities in its software. The program now offers bonuses for high-quality reports.
The program encourages researchers to disclose vulnerabilities responsibly and complements OpenAI’s Defense Factory, where engineers use the company’s models to find and reproduce vulnerabilities and test fixes.
New bounty payouts and bonuses
The midpoints of the reward ranges for medium, high, and critical findings more than quadrupled on average. Critical vulnerabilities in core products such as ChatGPT, Codex, and the API Platform can earn base bounties of up to $30,000. Exceptional critical findings remain eligible for base bounties of up to $100,000, with total payouts reaching up to $172,000 with bonuses.
High-quality reports are eligible for a multiplier on the base bounty. OpenAI says a reliable proof of concept helps engineers develop a fix by isolating the bug, showing when it can be exploited, and demonstrating its impact.
OpenAI introduced a five-tier loyalty program that offers larger bonuses at higher tiers. Short-term campaigns will have dedicated bonus pools for researchers who test newly launched features.
Updated payout calculation examples (Source: OpenAI)
“If you’ve already submitted a report and we haven’t yet awarded a bounty, we’ll apply the new reward ranges,” OpenAI said.
For bounties awarded in the 30 days before the announcement, the company will pay the difference if the finding would have earned more under the new ranges. The calculation includes base and loyalty awards.
