OpenAI Increases Security Bug Bounty Rewards

OpenAI announced that it is raising rewards in its Security Bug Bounty program to encourage independent researchers to pursue vulnerabilities in OpenAI software that internal testing may have missed. According to OpenAI, the company is more than quadrupling the midpoint of its reward ranges for medium, high, and critical findings on average. OpenAI said these updates complement work at its Defense Factory, where its engineers use models to find weaknesses, reproduce them, and test fixes.

Under the updated structure, OpenAI says a critical vulnerability in core products such as ChatGPT, Codex, or the API Platform will earn up to $30,000. According to OpenAI, exceptional critical findings on those targets remain eligible for up to $100,000, and up to $172,000 with bonuses. OpenAI also introduced a 5-tier loyalty bonus program and high-quality report multipliers. According to OpenAI, a reliable proof of concept that isolates a bug, shows when it can be exploited, and demonstrates its impact qualifies for quality multipliers.

OpenAI added that priority campaign multipliers will feature dedicated bonus pools for newly launched features. The company provided illustrative payout examples, including a medium-severity finding in ChatGPT increasing from a $750 historical award to $2,415, and a critical zero-click account takeover in ChatGPT increasing from a $6,500 historical award to $51,577.

According to OpenAI, the new reward ranges will apply retroactively to submitted reports that have not yet been awarded. For bounties awarded in the 30 days before the announcement, OpenAI says it will pay the difference if the finding would have earned more under the new ranges. Additionally, OpenAI stated its security team will be at PROMPT2PWN in Oakland on November 20-21, where researchers can test targets in person.