OpenAI is paying outside security researchers considerably more to find holes in its products. In a post on its website dated November 2, 2026, the company said it is raising rewards across its Security Bug Bounty program and adding bonuses meant to reward better-documented reports.
The headline change is the size of the base awards. OpenAI says the midpoints of its reward ranges for medium, high and critical findings have, on average, more than quadrupled. A critical vulnerability in a core product, which OpenAI defines as ChatGPT, Codex or the API Platform, can now earn up to $30,000. Exceptional critical findings on those products were already eligible for up to $100,000; with the new bonuses, OpenAI says they can now reach up to $172,000.
That top figure depends on stacking three new multipliers. The first rewards report quality: a submission with a reliable proof of concept that isolates the bug, shows when it can be exploited and demonstrates its impact can earn a bonus on the base bounty. The second is a five-tier loyalty program that pays scaling bonuses to researchers who report valid issues consistently. The third covers priority campaigns, short-term efforts with dedicated bonus pools for testing newly launched features.
OpenAI published worked examples to show how the math changes. In its illustration, a one-click ChatGPT account takeover that might previously have been paid $6,500 would now be worth about $51,577 once a $30,000 base award is multiplied by quality, priority-campaign and top-tier loyalty bonuses. An exceptional finding that breaks a major security boundary, such as viewing arbitrary users' chat messages, would rise from a $100,000 award to $171,925 with all three bonuses applied. OpenAI says the scenarios are illustrative.
The new ranges also reach backwards. OpenAI says reports already submitted but not yet awarded will be paid under the new ranges, and researchers who received bounties in the 30 days before the announcement will be paid the difference if their finding would have earned more under the new structure. Help Net Security notes that this top-up is calculated on base and loyalty awards.
The bounty changes arrived alongside a separate OpenAI post the same day announcing its next internal security sprint, in which researchers from the security firm Cathedral will work with OpenAI's own teams, using the company's models to probe its defenses. OpenAI says that during its previous sprint it dedicated 25% of its product engineers to finding and fixing weaknesses. The Decoder, which also reported the changes, says the new payouts put OpenAI roughly in line with Google's general vulnerability rewards program, though below the top awards Apple and Microsoft offer for operating-system-level exploits.
OpenAI says its security team will also be at the PROMPT2PWN event in Oakland on November 20 and 21, where researchers can test targets in person. For bug hunters, the practical takeaway is that a well-documented report on a core OpenAI product is now worth several times what it was a week ago.