OpenAI Bug Bounty Now Pays Up to $172,000 for Critical Flaws

The OpenAI bug bounty program now pays up to $30,000 for a critical flaw in ChatGPT, Codex or the API Platform, and up to $172,000 for the most serious finds once new bonuses are added. OpenAI announced the higher rewards on November 2, alongside a security sprint with Cathedral, the startup whose AI agents found a way into parts of Anthropic’s internal systems last month.

OpenAI says it is more than quadrupling the midpoint of its reward ranges for medium, high and critical bugs on average. The changes apply right away, and reports that have not been paid yet will be rewarded at the new rates.

How the New OpenAI Bug Bounty Payouts Work

Base rewards are only part of the new structure. According to OpenAI’s announcement, researchers can stack three kinds of bonuses on top of the base bounty:

• A quality multiplier for reports with a reliable proof of concept that isolates the bug and shows its impact.
• A new five-tier loyalty program that pays more to researchers who keep reporting issues.
• Short priority campaigns with dedicated bonus pools for newly launched features.

The company’s own examples, which it calls illustrative, show how big the jump is. A one-click ChatGPT account takeover that previously earned $6,500 would now pay $51,577 with the top bonuses. A medium bug that let a read-only member upload files to a ChatGPT Project rises from $750 to $2,415.

Exceptional critical findings, such as a flaw that lets someone read any ChatGPT user’s chats, were already eligible for up to $100,000. With stacked bonuses, that example now reaches $171,925. OpenAI will also pay the difference on bounties it awarded in the 30 days before the announcement if the new ranges would have paid more.

Cathedral Joins OpenAI’s Next Security Sprint

The bounty update is part of a broader push. In a separate post, OpenAI said Cathedral’s researchers will use its models alongside internal teams to “challenge our defenses” in its next security sprint. Neither company has said when the sprint starts or what Cathedral will be paid.

Cathedral is a young security firm founded by former DOGE staffers. In October, Decrypt and others reported, citing The Washington Post, that its AI agents found routes into a limited set of Anthropic’s sales, HR and IT systems in under 12 hours through third-party business software. Anthropic said Claude conversations, source code and model weights were not reached, and accused Cathedral of not fully following its program rules.

OpenAI said its previous sprint put 25% of its product engineers on finding and fixing weaknesses, using Codex to reproduce vulnerabilities and prepare patches. The company also pointed to a $1 billion commitment in subsidized model access for defenders of essential services through its Daybreak program.

Why AI Companies Are Paying More for Bugs

AI products now hold huge amounts of personal and business data, which makes them attractive targets. A recently reported ChatGPT shared link flaw, for example, showed how a single bug could expose private conversations.

Attackers are also using AI to move faster. A recent Northflank breach saw stolen AI API keys abused, and researchers recently showed an AI model building Firefox exploits from unshipped patches. Higher rewards are meant to make sure independent researchers report such holes to OpenAI first.

OpenAI’s security team will also be at the PROMPT2PWN event in Oakland on November 20 and 21, where researchers can test targets in person.