OpenAI Bug Bounty 2026: $30K Rewards and $172K Ceiling
OpenAI raised ChatGPT, Codex and API bug bounties. See the $30K critical ceiling, exceptional bonuses, retroactive awards and reporting rules.
OpenAI increased the rewards in its Security Bug Bounty program on November 2, 2026. The update matters to researchers examining ChatGPT, Codex and the API Platform, but the largest advertised figure is not a standard payment for finding any critical bug. There are different base ceilings, quality and loyalty multipliers, and rules for older submissions. Here is how to read the numbers without confusing a possible exceptional payout with a guaranteed reward.
What changed in the reward ranges
OpenAI says the midpoint of its reward ranges for medium-, high- and critical-severity findings increased by more than four times on average. For a critical vulnerability in a core product such as ChatGPT, Codex or the API Platform, the new ordinary ceiling is up to $30,000. Exceptional critical findings remain eligible for a base reward of up to $100,000. The company says an exceptional finding can reach approximately $172,000 when eligible bonuses are included.
Understand the advertised ceilings
| Reward category | What OpenAI actually announced |
|---|---|
| Critical issue in a core product | Up to $30,000, depending on the finding and program decision |
| Exceptional critical issue | Up to $100,000 before applicable bonuses |
| Exceptional issue with eligible bonuses | Up to approximately $172,000; not a guaranteed or standard payout |
OpenAI labels its published payout scenarios illustrative. A dollar figure in an example is not a promise that every similar-looking report will receive that amount. The current Bugcrowd program brief controls the detailed scope and rules; those dynamic terms could not be independently inspected for this article.
Why the bonus structure matters
The update introduces three additional ways a researcher may earn more. A report-quality multiplier rewards a reliable proof of concept that isolates the issue and shows exploitability and impact. A five-tier loyalty program recognizes repeat contributors. Priority campaigns can add temporary bonus pools for testing newly launched features. These mechanisms can interact in OpenAI's examples, but the precise award for a real report depends on the program's current terms and the actual finding.
For perspective, OpenAI's example of a critical one-click ChatGPT account takeover starts with a $30,000 base and applies quality, priority and loyalty multipliers to reach $51,577. Its exceptional example starts at $100,000 and arrives at $171,925 after illustrative bonuses. Those are calculations from the announcement, not independently observed researcher payments. Avoid using them as expected earnings or as a fixed rate card.
Retroactive rewards and the reporting route
The company says reports already submitted but not yet awarded will use the new reward ranges. For bounties awarded in the 30 days before the November 2 announcement, OpenAI says it will pay the difference when the report qualifies under the new ranges. That does not establish a blanket increase for every historical report. Researchers should retain their original submission and award details and consult the official program for their particular case.
OpenAI operates a Security Bug Bounty and a separate Safety Bug Bounty. The security program concerns conventional vulnerabilities and unauthorized access to products, data or functions. The safety program covers certain AI misuse and abuse risks, including specified agentic prompt-injection scenarios, even where there is no conventional security flaw. OpenAI says reports can be routed between its teams depending on scope; the applicable rules should be checked before testing or submission.
A practical checklist before reporting
- Open the official Bugcrowd program and review its current in-scope assets, testing permissions, exclusions and disclosure requirements before attempting any test.
- Confirm the issue is reproducible, identify the affected product and explain the security impact without accessing unrelated users' data.
- Prepare a minimal proof of concept with clear steps, expected behavior, actual behavior and enough evidence for a reviewer to validate it safely.
- Decide whether the report is primarily a conventional security flaw or an AI safety/abuse issue, and use the matching program guidance.
- Submit through the authorized reporting channel, avoid public disclosure outside its rules, and do not assume a specific payout until OpenAI makes an award decision.
For developers building with AI agents, the useful signal is not only the headline prize. OpenAI is explicitly paying more for reproducible, high-impact findings and better reports. That raises the value of careful authorization checks, minimal test cases and evidence that separates an actual security boundary failure from a surprising model response. It does not authorize aggressive testing beyond the program scope.
Questions people ask
Does OpenAI guarantee $172,000 for a critical ChatGPT vulnerability?
No. OpenAI says a critical vulnerability in a core product can earn up to $30,000, while an exceptional critical finding can receive a base award of up to $100,000. The roughly $172,000 figure includes illustrative bonus multipliers. A real payout depends on the accepted finding, severity, quality and current program rules; it is not a standard reward for every critical report.
Can a report submitted before November 2 receive the higher reward?
Yes, in specific circumstances. OpenAI says reports submitted but not yet awarded will be assessed using the new ranges. It also says qualifying awards made in the 30 days before its November 2, 2026 announcement will receive a difference payment. The announcement does not promise a retroactive increase for all older awards; researchers should check their submission and award status.
Should an AI prompt-injection finding go to the Security or Safety Bug Bounty?
It depends on the impact and the applicable program scope. OpenAI's Safety Bug Bounty covers certain agentic prompt-injection and misuse cases, while issues that give unauthorized access to features, data or functionality are directed to its Security Bug Bounty. OpenAI says the teams may reroute submissions. Researchers should review both official briefs before testing and avoid assuming every model jailbreak qualifies.
What evidence helps a vulnerability report qualify for a quality bonus?
OpenAI specifically highlights a reliable proof of concept that isolates the bug, demonstrates when it can be exploited and explains its impact. A clear reproduction path and a concise description of the security boundary involved are more useful than a vague claim. The quality multiplier is conditional, and the exact award remains subject to the live Bugcrowd program terms and OpenAI's review.
OpenAI's November 2 update makes its security bounty materially more attractive for qualified researchers, with up to $30,000 for ordinary critical core-product findings and a much higher possible exceptional payout after bonuses. The actionable next step is to verify the current program scope and submit a precise, responsibly obtained report. Treat every maximum as conditional, not guaranteed.
Explore related Make Better resources
- GitHub AI App Scanning: Setup, XPIA and Limits— Related defensive testing and prompt injection security.
Sources & useful resources
- OpenAI: November 2, 2026 security bounty update— Primary payout and bonus details, illustrative calculations and retroactivity.
- OpenAI: Safety Bug Bounty program scope— Primary source for distinguishing AI safety and abuse issues from conventional security vulnerabilities.
- OpenAI: coordinated vulnerability disclosure policy— Official responsible disclosure and reporting guidance.
- OpenAI Security Bug Bounty on Bugcrowd— Official program page; its dynamic scope and eligibility terms were not independently readable in this run.