OpenAI: core-product critical bug rewards now up to US$30,000
Exceptional findings may reach about $172,000 with qualifying bonuses, subject to program rules.
OpenAI announced higher Security Bug Bounty rewards on November 2, 2026. Critical findings in ChatGPT, Codex and the API Platform can receive base rewards up to US$30,000. Exceptional findings may reach about US$172,000 with eligible bonuses.
The announcement presents the new rates as current but gives no exact activation time.
This changes bounty terms, not chat features, and does not guarantee payment for every report. Researchers must verify authorized scope, eligibility and rules before testing. The announcement is not blanket testing permission. We performed no vulnerability testing.
The announcement presents the new rates as current but gives no exact activation time.
This changes bounty terms, not chat features, and does not guarantee payment for every report. Researchers must verify authorized scope, eligibility and rules before testing. The announcement is not blanket testing permission. We performed no vulnerability testing.
Usage conditions
- Hong Kong
- Researcher eligibility, payout conditions and report languages for Hong Kong are not specified by location in the announcement and require the full program rules. Maximum awards are not guaranteed income. No new paid plan is announced, nor does this establish changed local ChatGPT, app or API access.
- Macau
- Researcher eligibility, payout conditions and report languages for Macau are not specified by location in the announcement and require the full program rules. Maximum awards are not guaranteed income. No new paid plan is announced, nor does this establish changed local ChatGPT, app or API access.
- Taiwan
- Researcher eligibility, payout conditions and report languages for Taiwan are not specified by location in the announcement and require the full program rules. Maximum awards are not guaranteed income. No new paid plan is announced, nor does this establish changed local ChatGPT, app or API access.
Official source: Rewarding defenders with bigger bug bounties