OpenAI raises bug bounty rewards and retroactively pays the difference

Nov 3

1. 18:42

   The Decoder

   OpenAI raises bug bounties to a maximum of about $172,000

   OpenAI announced it is quadrupling its bug bounties: critical vulnerabilities in core products such as ChatGPT and Codex can earn up to $30,000, exceptional findings can reach $100,000, and with quality, loyalty, and event bonuses stacked on top, the total comes to about $172,000. It added a five-tier loyalty program and time-limited bonus campaigns tied to new product launches, and those who submitted vulnerability reports in the past 30 days will receive the difference between the old and new rates. OpenAI is also preparing a security sprint in which the security firm Cathedral and its own engineers will stress-test its systems together; the company says 25% of its product engineers took part in vulnerability hunting during the last sprint.

   Expand summary
2. 14:02

   Unite.AI

   OpenAI Plans New Security Sprint and Raises Bug Bounty

   OpenAI announced plans to conduct a new round of internal security sprints with external researchers such as Cathedral. On the same day, the bug bounty update raised the median reward ranges for medium-, high-, and critical-severity vulnerabilities by an average of more than fourfold. Critical vulnerabilities in core products such as ChatGPT, Codex, or the API Platform can earn up to $30,000, and particularly severe findings can reach $172,000 after bonuses. In previous sprints, OpenAI committed 25% of its product engineers, used Codex to reproduce vulnerabilities and prepare patches, mobilized more than 250 people covering over 100 service areas, and closed 53 urgent or high-priority issues on the first day. OpenAI will also open its strongest models to Daybreak customers for authorized defensive work, a program corresponding to a $1 billion commitment and a six-month usage target.

   Expand summary
3. 10:29

   OpenAIFirst-party

   OpenAI Increases Bug Bounties and Retroactively Pays the Difference

   OpenAI said the updated bug bounty rewards also apply to reports still awaiting a bounty; for bounties paid within the past 30 days, if the finding would qualify for a higher reward under the new standards, the difference will be paid retroactively. Previously, OpenAI announced an internal security sprint in partnership with Cathedral Systems and increased bounties for critical findings by more than fourfold, with bonuses reaching up to $172,000.

   Expand summary