OpenAI just raised the price on its own mistakes. A critical bug in ChatGPT, Codex, or the API Platform now pays up to $30,000 — and an exceptional finding can reach up to $172,000 with bonuses.
That is the new table in OpenAI’s Security Bug Bounty program, announced November 2, 2026, alongside a new internal security sprint with outside firm Cathedral. For independent researchers, clean, reproducible reports on core products are now worth serious money.
What changed on November 2
OpenAI says it more than quadrupled the midpoint of its reward ranges for medium, high, and critical findings on average. From OpenAI’s official bug bounty announcement:
- Up to $30,000 for a critical vulnerability in a core product: ChatGPT, Codex, or the API Platform.
- Up to $100,000 for exceptional critical findings on those targets, before bonuses.
- Up to $172,000 for those findings once bonuses stack — OpenAI’s own example calculates $171,925.
Three bonus systems drive the top end: a quality multiplier for a reliable proof of concept, priority campaigns with bonus pools for newly launched features, and a five-tier loyalty program for repeat researchers. The multipliers stack, which is why a $100,000 base can become $171,925.
OpenAI’s own payout examples
| Example finding | Old award | New calculation | New reward |
|---|---|---|---|
| Medium, ChatGPT (core): read-only member uploads files to a Project | $750 | $2,000 × 1.15 quality × 1.05 Bronze | $2,415 |
| High, Prism (non-core): IDOR reads a file from a user’s Project | $1,000 | $2,500 × 1.15 quality × 1.10 Gold | $3,162.50 |
| Critical, ChatGPT (core): one-click account takeover | $6,500 | $30,000 × 1.15 × 1.30 campaign × 1.15 loyalty | $51,577 |
| Exceptional, ChatGPT (core): major security-boundary compromise | $100,000 | $100,000 × 1.15 × 1.30 × 1.15 | $171,925 |
Source: OpenAI’s announcement. All scenarios and historical awards are illustrative, per OpenAI — actual rewards depend on target, severity, and bonus eligibility.
Two retroactive rules matter if you already reported something. Reports not yet awarded get the new ranges. Bounties awarded in the 30 days before the announcement get topped up if they would have earned more, counting base plus loyalty awards.
Test an in-scope target with your own account
Reliable proof of concept, exploit path, impact
Submit via Bugcrowd, no conditions
Base reward × quality × campaign × loyalty
Jailbreaks and prompt-only safety bypasses are out of scope. A model-assisted attack only counts if it exploits a separate flaw in an in-scope product.
Cathedral joins the next security sprint
In OpenAI’s security sprint post, the company says it is planning its next internal sprint with Cathedral, whose researchers will use OpenAI’s models alongside OpenAI’s teams to challenge its defenses.
The last sprint shows the model: OpenAI dedicated 25% of its product engineers to finding and fixing weaknesses, using Codex to investigate findings, reproduce vulnerabilities in isolated environments, and prepare patches for review. OpenAI calls this continuous defense, not a one-off audit.
The company is also making its most capable models available to Daybreak customers, with $1 billion committed in subsidized access over six months for frontline defenders protecting essential services. Its security team will also be at PROMPT2PWN in Oakland on November 20–21, 2026.
What does NOT pay
Do not waste a week on the wrong target. Findings limited to model behavior — jailbreaks, hallucinations, and prompt-only safety bypasses — are out of scope, per OpenAI’s Bugcrowd program page.
A model-assisted attack can still qualify, but only if it exploits a separate flaw in an in-scope product or integration. Showing a chatbot says something bad earns nothing; showing a trick that reads another user’s chats is the $100,000 example. Disclosure must be unconditional; extortion or pressure tactics void safe harbor.
How to profit from OpenAI’s $172,000 bounty
- Read the scope on Bugcrowd first. Confirm targets, severity, and current campaigns at OpenAI’s Security Bug Bounty on Bugcrowd before testing.
- Start with access control, not prompts. OpenAI’s examples reward Project permissions, IDOR file access, and account takeover — classic web security.
- Write the report like a fix ticket. Isolate the bug, show when it can be exploited, and demonstrate impact. That is what the quality multiplier pays for.
- Build loyalty deliberately. Repeat valid reports move you up the five tiers — the difference between $30,000 and $51,577 in OpenAI’s critical example.
- Time new features. Priority campaigns pay up to 1.30x for testing newly launched features, so test early and report cleanly.
- Never touch other users’ data. Use test accounts and disclose unconditionally. A great finding reported badly can lose safe harbor — and the payout.
OpenAI is buying a standing army of outside testers — and running its own agents against its own defenses too.
Frequently asked questions
How much does OpenAI’s bug bounty pay now?
Up to $30,000 for a critical bug in a core product, up to $100,000 for exceptional findings, and up to $172,000 with bonuses.
Where do I submit an OpenAI bug bounty report?
Through OpenAI’s Security Bug Bounty program on Bugcrowd. Read the policy and scope before testing.
Are jailbreaks covered?
No. Findings limited to model behavior, including jailbreaks and prompt-only safety bypasses, are out of scope.
How do the multipliers work?
They stack: up to 1.15x quality, up to 1.30x priority campaign, and up to 1.15x loyalty. Example: $100,000 × 1.15 × 1.30 × 1.15 = $171,925.
Will old reports get the new rates?
Reports not yet awarded get the new ranges; bounties awarded in the prior 30 days get topped up if they would have earned more.
What is Cathedral’s role?
Cathedral’s researchers will use OpenAI’s models alongside OpenAI’s teams in its next internal security sprint.
What is Daybreak?
OpenAI’s program for frontline defenders, with $1 billion in subsidized access over six months for essential services and digital infrastructure.