Bug Hunters Now Earn Up to $172,000 Per Find
OpenAI's higher bounty ceilings aim to draw independent researchers into testing ChatGPT and its developer tools for serious flaws.
Updated on Nov. 3, 2026 in Artificial Intelligence
OpenAI has raised the payouts in its security bug bounty program, and the midpoints of reward ranges for medium, high, and critical findings more than quadrupled on average. The change is in effect now rather than a preview, and OpenAI will pay the difference on qualifying bounties awarded in the 30 days before the announcement.
Why it matters
The move signals that OpenAI is paying more to attract outside researchers to find flaws in its consumer and developer products before attackers do. It also points to a broader industry trend of AI firms competing for scarce security talent as their products handle more sensitive data.
The published schedule shows the reward structure rather than payout totals: critical findings in core products carry base bounties up to $30,000 and exceptional ones up to $100,000 before bonuses. The source does not state how many reports have been paid at these levels or what share of submissions qualify.
The players
OpenAI
Developer of ChatGPT, Codex and the API Platform, whose security bug bounty program invites outside researchers to report vulnerabilities in those products.
The details
Researchers submit vulnerability reports through OpenAI's bounty program, and each accepted report earns a base award set by severity tier. High-quality reports receive a multiplier on that base, and a five-tier loyalty program adds larger bonuses for researchers at higher tiers. Short-term campaigns will also carry dedicated bonus pools aimed at researchers who test newly launched features.
Timeline
30 days before the announcement: bounties were awarded that are eligible for retroactive difference payments.
November 3, 2026: OpenAI announced the increased bug bounty payouts.
The Tech Race
OpenAI is raising its bug bounty ceiling as AI companies compete for the same pool of independent security researchers. The change places the company's security incentives alongside the broader industry move toward larger, tiered bounty programs.
The new reward ranges apply to reports now, and the retroactive difference payments cover bounties awarded in the 30 days before the announcement. Users of ChatGPT, Codex and the API Platform are the indirect beneficiaries, as stronger incentives aim to surface flaws before they reach them.
The takeaway
Watch for the bonus pools tied to new feature launches, since they will show how OpenAI targets researchers at the moments its products are most exposed. Security researchers and developers can also track future updates to the published reward schedule for changes to the tier and loyalty terms.
Further reading
For more on the tools this program protects, see Artificial Intelligence coverage across the United States.
