OpenAI raises bug bounties: critical flaws in ChatGPT, Codex and the API pay up to $30,000
Serguey Asael Shinder1 min readOpenAI has raised the payouts in its Security Bug Bounty programme. The company says it is more than quadrupling, on average, the midpoint of its reward ranges for medium, high and critical findings. A critical vulnerability in a core product, which OpenAI names as ChatGPT, Codex and the API Platform, now earns up to $30,000. Exceptional critical findings on those targets stay eligible for up to $100,000, and with bonuses for up to $172,000.
Three bonus mechanisms are new. A quality multiplier rewards reports with a reliable proof of concept that isolates the bug, shows when it can be exploited and demonstrates its impact. A five-tier loyalty programme scales bonuses for researchers who report repeatedly. And priority campaigns put dedicated bonus pools on newly launched features for a short period. OpenAI's own worked examples multiply a $30,000 one-click account takeover by 1.15 for quality, 1.30 for a priority campaign and 1.15 for the top loyalty tier.
Reports already submitted but not yet paid will be assessed under the new ranges, and the company says it will also adjust bounties awarded in the 30 days before the announcement. OpenAI presents the programme as a complement to its internal work in which engineers use its models to find, reproduce and test fixes for weaknesses.
What it means
For researchers the practical change is that the write-up now carries money: a clean, isolated proof of concept is paid as a multiplier, not just as goodwill. For teams that build on the API, the signal is the list of core assets, because that is where OpenAI is now paying most to find problems first.