OpenAI updated its Security Bug Bounty program on November 2. A critical vulnerability in a core product (ChatGPT, Codex or the API Platform) now earns up to $30,000. Exceptional critical findings on those targets stay eligible for up to $100,000, and up to $172,000 once bonuses are added.
Three bonus types are new. A quality multiplier pays extra for a report with a reliable proof of concept that isolates the bug and shows its impact. A five-tier loyalty program adds a percentage for repeat researchers. And priority campaigns put dedicated bonus pools on newly launched features for a short time.
OpenAI's worked examples make the jump concrete. A medium ChatGPT bug (a read-only member uploading files to a Project) that once paid $750 would now pay $2,415. A zero-click ChatGPT account takeover that paid $6,500 would now pay $51,577 with every bonus applied. OpenAI calls all of these illustrative.
The new ranges apply to submitted reports that haven't been paid yet. For bounties paid in the 30 days before the announcement, OpenAI says it'll pay the difference. Its security team will also be at PROMPT2PWN in Oakland on November 20 and 21.