Rewarding defenders with bigger bug bounties
- ID
- 42321
- Status
- summarized
- Published
- 03 Nov 2026, 2:00 AM
- Fetched
- 03 Nov 2026, 11:55 AM
- Provider
- OpenAI News
- Category
- ai-labs
- Original URL
- https://openai.com/index/rewarding-defenders-with-bigger-bug-bounties
- Source URL
- https://openai.com/news/rss.xml
Summary
- Score
- 4.0
- Created
- 03 Nov 2026, 11:55 AM
- Tags
- Audience
- developersai_agent_userssaas_founders
What happened
OpenAI raised bug bounty rewards, more than quadrupling the midpoint of reward ranges for medium, high, and critical findings. A critical vulnerability in ChatGPT, Codex, or the API Platform now pays up to $30,000, with exceptional critical findings up to $100,000 and up to $172,000 with bonuses. OpenAI also added quality-report multipliers, a 5-tier loyalty bonus, and priority campaign pools; one example shows a medium ChatGPT file-upload permission bug rising from $750 to $2,415 after quality and Bronze loyalty multipliers.
Why it matters
If you have a reproducible vulnerability in ChatGPT, Codex, or the OpenAI API Platform, the payout table has changed enough to check before reporting: a medium finding can now clear $2,400 in the example, and critical findings can reach $172,000 with bonuses. If you are just building on OpenAI, there is no product, pricing, or compliance change here, so do not change your architecture because of this announcement.
Discussion angle
Does paying much more for external bug reports make more sense than expanding internal AI-assisted defense, and what does the $750-to-$2,415 example say about how much quality proof-of-concept work is worth?