OpenAI has quadrupled its bug bounty payouts and launched a new internal security sprint to address vulnerabilities in core products like ChatGPT and Codex. Critical flaws now earn external researchers up to $30,000, while exceptional findings can net $100,000. With loyalty bonuses and campaign incentives, total rewards for a single researcher could reach roughly $172,000. This places OpenAI alongside Google in terms of general vulnerability rewards, though it remains below the top-tier payouts offered by Apple or Microsoft for operating system exploits. The company also introduced a five-tier loyalty program and time-limited campaigns with boosted rates tied to new feature launches. Anyone who reported a vulnerability in the last 30 days will receive the difference between the old and new rates retroactively.
Alongside the bounty overhaul, OpenAI is preparing a security sprint where the security firm Cathedral will team up with OpenAI’s own engineers to stress-test its systems. During the last sprint, 25 percent of OpenAI’s product engineers worked on finding vulnerabilities. This shift signals a higher priority on proactive defence rather than reactive patching. The company aims to catch issues before they reach widespread use in production environments.
- Retroactive pay covers reports made in the last 30 days
- Cathedral security firm joins internal engineering teams for testing
- Half of product engineers dedicated to vulnerability hunting previously
