OpenAI is offering larger rewards to outside researchers who find security vulnerabilities in its products. The company has quadrupled its bug bounty payouts and is also preparing a security sprint that will bring its engineers together with the security firm Cathedral to test its systems.
Higher rewards for serious vulnerabilities
Under the updated program, researchers can earn up to $30,000 for critical vulnerabilities in core products like ChatGPT or Codex. Exceptional findings can earn up to $100,000.
The maximum potential reward can rise to roughly $172,000 when quality, loyalty, and campaign bonuses are included. That figure combines the base reward structure with additional incentives, so it is not a flat payout for every report.
The larger amounts raise the potential return for researchers who identify serious issues. For OpenAI, the program gives outside researchers a financial incentive to report vulnerabilities through its bounty process.
Bonuses add new incentives
OpenAI has added a five-tier loyalty program and time-limited campaigns with boosted payouts. The campaigns are tied to new feature launches, linking higher rewards to periods when new features are being introduced.
The loyalty tiers add another element to the program: compensation can reflect a researcher's standing as well as the vulnerability itself. The article does not detail the tier requirements or how individual bonuses are calculated, but it says quality, loyalty, and campaign bonuses can contribute to the roughly $172,000 maximum.
There is also a retroactive adjustment for recent reports. Anyone who reported a vulnerability in the last 30 days will get the difference between the old and new rates. That means the increase can apply to eligible reports already submitted, rather than only to future findings.
Internal engineers join the search
The bounty changes are part of a broader push to test OpenAI's systems. The company is preparing a security sprint in which Cathedral will work with OpenAI's own engineers to stress-test those systems.
The arrangement combines external security expertise with people inside the company. A sprint creates a focused period for looking for vulnerabilities, while the bounty program gives outside researchers a continuing reason to report what they find.
OpenAI says that during the last sprint, 25 percent of its product engineers worked on finding vulnerabilities. That figure shows the scale of internal participation in the previous effort, though the article does not say how long that sprint lasted or how many vulnerabilities it uncovered.
How the program compares
The article places OpenAI's revised rewards in the same ballpark as Google's general vulnerability rewards program. It also says OpenAI remains below the top-tier payouts Apple or Microsoft offer for OS-level exploits.
Those comparisons cover different kinds of programs and vulnerabilities. The stated maximum for OpenAI includes bonuses, while the comparison with Apple and Microsoft refers specifically to top-tier rewards for OS-level exploits. The figures therefore offer context about the program's scale, rather than a direct comparison of identical findings.
Together, higher payouts, loyalty tiers, limited-time campaigns, and coordinated security sprints give researchers and employees several routes to help identify weaknesses. The source describes the changes and incentives, but does not specify the campaign schedule, bonus formulas, or the results expected from the upcoming sprint.