OpenAI Raises Bug Bounty Rewards and Adds Bonuses for Security Researchers

According to OpenAI and coverage by Cyber Security News, a critical vulnerability in one of the company's core products, which include ChatGPT, Codex and the API Platform, can now earn up to $30,000. Findings that OpenAI classes as exceptional critical issues keep a $100,000 base award, and with bonuses the potential payout rises to about $172,000. Cyber Security News noted that the top-tier amounts should be read as exceptional cases rather than the standard reward for a critical bug. Superpower Daily described the change as OpenAI "more than quadrupling rewards for critical bug-bounty findings".

How the Bonuses Work

The quality bonus rewards reports that come with a reliable proof of concept. The loyalty bonus is a tiered scheme meant to keep experienced researchers working with OpenAI over time. Priority campaigns are time-limited promotions that pay extra for qualifying reports in particular vulnerability categories. OpenAI has used that format before: in 2025 it doubled payouts for insecure direct object reference flaws for a limited period, when it also lifted its maximum critical award from $20,000 to $100,000. Final payouts still depend on scope, severity and the evidence a researcher provides.

A Second Security Sprint

The bounty changes come as OpenAI prepares its next internal security sprint, for which it has named Cathedral Systems as a partner. Cathedral researchers will use OpenAI's models alongside the company's own teams to test its defences, according to the reports. OpenAI has not said when testing will start or which systems are in scope.

In the previous sprint, about 25 percent of OpenAI's product engineers worked on finding and fixing weaknesses, using Codex to investigate reports, reproduce vulnerabilities in isolated environments and prepare patches for human review, Cyber Security News reported. Lessons from that exercise included that duplicate findings slowed triage, severity ratings needed clearer guidance, and a merged patch did not always mean a fix had reached every deployed system. OpenAI plans to share the blueprint and lessons from the sprint with industry and government cyber defenders, Superpower Daily reported.

Why It Matters

OpenAI framed the work around the idea that as AI gets better at finding vulnerabilities, defenders need to use it before attackers do. Higher bounties are a way to draw more outside scrutiny to products that now sit inside many corporate workflows, from chat assistants to coding agents with access to source code. For security leaders, the move is a signal of how seriously AI vendors are starting to treat their own attack surface, and a reminder that the products their staff use are being actively probed by both researchers and adversaries.

The announcement follows a UK National Cyber Security Centre warning this week that an AI-powered attack on critical infrastructure is likely by 2028.