OpenAI raises top bug bounty payout to $172,000

Boosting the reward for flaws

OpenAI is significantly increasing the financial rewards it offers to independent researchers who discover security vulnerabilities in its software. As reported by Help Net Security, the company wants to incentivize people to find and report bugs responsibly rather than exploiting them. This move is part of a broader effort to harden the security of its AI infrastructure.

The new payout structure sees the midpoints for medium, high, and critical findings more than quadruple on average. By increasing these amounts, OpenAI hopes to draw in a wider pool of skilled security professionals. The goal is to identify weaknesses in the systems that power popular tools like ChatGPT and the API Platform.

The company is also introducing specific bonuses for reports that meet a high standard of quality. These rewards are designed to encourage researchers to provide thorough documentation. A reliable proof of concept is particularly valued because it helps engineers isolate a bug and see how it might be exploited.

How the new system works

The updated program uses a base bounty system combined with various multipliers and loyalty rewards. For critical vulnerabilities in core products, the base bounty can reach up to $30,000. However, for findings that are considered exceptional, the base bounty can go as high as $100,000. When bonuses are added, the total payout can reach $172,000.

OpenAI also introduced a five-tier loyalty program to reward researchers who consistently contribute to the platform. This system offers larger bonuses as researchers move into higher tiers based on their history of high-quality submissions. This structure rewards long-term contributors who help maintain the security of the ecosystem over time.

In addition to the permanent changes, the company will launch short-term campaigns with dedicated bonus pools. These specific pools are intended for researchers who test and find issues in newly launched features. This allows OpenAI to focus security attention on the newest parts of its software as they are released to the public.

Internal and external defense

The bug bounty program does not work in isolation but instead complements OpenAI's internal security efforts. The company operates a team called the Defense Factory, where engineers use the company's own models to find and reproduce vulnerabilities. This internal team works to test and verify fixes for the bugs that are identified.

By combining internal testing with external bug bounties, OpenAI creates a multi-layered defense strategy. The Defense Factory provides a proactive way for the company to find flaws using automated and manual methods. Meanwhile, the bounty program leverages the diverse skills of the global security research community.

The interaction between these two systems ensures that vulnerabilities are addressed more quickly. When an external researcher finds a bug, the internal team can use the provided proof of concept to develop a fix. This collaborative approach helps ensure that the software remains stable and secure for all users.

Impact on researchers and users

For security researchers, these changes mean that finding a critical flaw in an AI product is now a much more lucrative opportunity. The significant increase in the midpoint rewards makes it more attractive for professionals to dedicate time to auditing OpenAI's software. It also provides a clearer path for researchers to earn more through the new loyalty tiers.

For the average user, these changes are intended to increase the overall safety of AI tools. By rewarding researchers to find bugs first, the company aims to prevent these flaws from being used by bad actors. This helps protect user data and the integrity of the AI models that many people rely on for work and personal use.

OpenAI is also making sure that existing reports are not left behind during this transition. If a researcher has already submitted a report that is still pending, the company will apply the new reward ranges. For bounties awarded in the 30 days before the announcement, OpenAI will pay the difference if the finding would have earned more under the new rules.

What comes next for AI security

This move signals a growing trend in the AI industry where companies are putting more money behind security research. As AI models become more complex, the surface area for potential attacks grows larger. Offering high-value bounties is a way to stay ahead of sophisticated threats that target the core logic of these models.

The focus on high-quality reports and proof of concepts suggests that OpenAI wants more than just a list of bugs. They want actionable information that allows their engineers to move quickly from discovery to resolution. This level of detail is essential for securing products that are used by millions of people simultaneously.

The success of this program will likely be measured by the volume and severity of the bugs found in the new loyalty tiers. As more researchers join the program, OpenAI will have to manage a larger influx of data. This will test their ability to triage reports and maintain a high standard of security for their entire platform.