Bug Bounty

OpenAI quadruples bug bounty rewards, top payout now $172,000

OpenAI reportedly more than quadruples bug bounty reward ranges and lifts its top payout to $172,000. What it means for UK researchers and bounty budgets.

Illustration of a bug icon with the headline OpenAI lifts top bug bounty to $172,000

OpenAI has rewritten the price list for its bug bounty. According to reports of its announcement, average reward midpoints have more than quadrupled and exceptional findings are now worth up to $172,000 once bonuses are added. For UK researchers it is a richer target, and for UK organisations running their own programmes it is a fresh benchmark for what a serious AI platform flaw is worth.

What happened

On 2 November 2026 OpenAI published two posts: one overhauling its Security Bug Bounty and another setting out its next internal security sprint. According to summaries of the bounty post carried by daily.dev, CellCog and Borncity, the company is more than quadrupling, on average, the midpoint of its reward ranges for medium, high and critical findings.

As reported across those outlets, a critical vulnerability in ChatGPT, Codex or the API Platform now pays up to $30,000. Exceptional critical findings keep a base ceiling of $100,000, but bonuses can lift the total to $172,000. AlphaSignal notes that the programme launched on Bugcrowd in April 2023 with a $20,000 maximum, so the top possible award has grown more than eightfold in three and a half years.

The same reports say the new ranges will apply to reports still open, and that awards made in the 30 days before the announcement will be topped up without researchers needing to resubmit. This site has reported two recent individual OpenAI payouts of $5,000 and $6,000, and it is the scale of the uplift rather than any single award that makes this announcement significant.

Alongside the bounty changes, OpenAI named Cathedral Systems as an outside partner for its next security sprint, with Cathedral researchers using OpenAI models alongside internal teams to probe its defences. Cathedral is the same firm Anthropic accused last month of breaking its bounty rules, a dispute Cathedral rejects.

The detail

The structure of the new scheme matters as much as the ceiling. Reports describe four bonus mechanisms layered on top of the base award:

  • A quality multiplier for submissions with a reliable proof of concept, which daily.dev reports as 1.15x in OpenAI’s FAQ.
  • A five-tier loyalty scheme with rising percentage bonuses for researchers who keep reporting.
  • Priority campaigns with dedicated bonus pools for newly launched features.
  • Back pay for recent awards and open reports at the new rates.

OpenAI’s own worked examples, as reproduced by CellCog, show how far the numbers have moved. A medium ChatGPT finding previously paid at $750 would now be worth $2,415. A critical ChatGPT account takeover that earned $6,500 would now attract $51,577, a figure Borncity also reports. An exceptional finding that allowed viewing of any user’s chats moves from $100,000 to $171,925. CellCog says OpenAI describes these scenarios as illustrative rather than a guaranteed tariff.

Scope has sharpened too. According to AlphaSignal, the top rewards are aimed at concrete agentic abuse and platform integrity risks, meaning cases where an AI system takes harmful actions through tools, files or connected services. Simple jailbreaks without a demonstrated impact remain out of scope, and agentic findings must reproduce in at least half of attempts to qualify for the highest payouts. That bar is a sensible answer to the non-deterministic behaviour of language models.

The sprint post explains the wider context. In OpenAI’s previous sprint, roughly a quarter of its product engineers spent time finding and fixing weaknesses, using Codex to reproduce issues in isolated environments and draft patches for review. OpenAI’s announcement on X framed the logic bluntly: “defenders need to put it to work before attackers do.”

Key figures from OpenAI's revised bug bounty: $172,000 top payout, $100,000 base ceiling, $30,000 core critical, $6,500 to $51,577 account takeover example, 30-day back pay

Why it matters for UK organisations

For UK researchers, this is now one of the better paying programmes for application and platform work. Hunting within a published scope is also the safest place to do security research under current UK law. Authorisation from the system owner is what keeps a tester on the right side of section 1 of the Computer Misuse Act 1990, and a clearly worded bounty policy provides exactly that.

The picture is less tidy outside formal programmes. During Lords debates on the Cyber Security and Resilience Bill, ministers confirmed that the Home Office has drafted proposals for a section 1 defence for accredited researchers, but said it will come through separate national security legislation. As commentators have pointed out, no accreditation body, cost or eligibility criteria have been published. Until that changes, UK researchers who find flaws in organisations without a vulnerability disclosure policy remain exposed in a way their OpenAI work does not.

For UK organisations, the more important signal is price. When a major platform values a single account takeover at over $50,000, its budget is effectively setting market expectations for skilled researcher time. Firms with modest programmes, or an unrewarded disclosure inbox, will find the best researchers spend their hours elsewhere. OpenAI’s emphasis on agentic abuse is also a reminder that the riskiest failures now involve AI tools acting with real permissions.

Expert view

In my experience, the size of a bounty ceiling is less telling than the plumbing around it. Back pay, reproducibility rules and quality multipliers tell you a vendor has thought about triage cost, and triage is where most programmes fail. Slow validation burns goodwill quickly.

The Cathedral appointment is the part I would watch. Bringing in an outside offensive team, with model access, is a legitimate way to test defences, but it only works with tight rules of engagement and clear data handling. Given the Anthropic dispute, OpenAI will need robust engagement terms, and anyone considering AI-assisted red teaming should watch how scope is written.

The quality multiplier reflects a wider shift: automated tooling now produces far more candidate findings than a decade ago, much of it noise. Paying more for a clean proof of concept pushes researchers towards fewer, better reports.

What to do now

  1. Publish a vulnerability disclosure policy if you do not have one, with a security.txt file and a clear safe harbour statement. The NCSC Vulnerability Disclosure Toolkit is a good starting point, and it gives researchers the authorisation the Computer Misuse Act currently demands.
  2. Benchmark your bounty budget against the market, especially for account takeover and data exposure, and decide whether a private programme on a platform is a better use of limited funds than a thin public one.
  3. Resource triage before raising rewards. Set response time targets, require reproducible proof of concept and consider bonuses for quality rather than volume.
  4. Scope AI features explicitly. If your products use OpenAI or similar models with tool access, state whether prompt injection and agent misuse are in scope and what impact you expect researchers to show.
  5. Apply least privilege to AI integrations. Limit the permissions of service accounts and tokens used by agents, in line with the Cyber Essentials user access control requirements, and keep secrets out of prompts and logs.
  6. Write rules of engagement for any third party red team, covering data handling, stop conditions and disclosure, before you grant access.

Bottom line

OpenAI has raised the price of a serious AI platform flaw and paired it with a contentious testing partner. UK organisations should treat the new numbers as a benchmark and fix their own disclosure arrangements before law reform arrives.

Sources

Related Posts