Artificial Intelligence
OpenAI lifts bug bounty payouts to $172,000
OpenAI updated its security bug bounty programme with higher base awards, report-quality multipliers, loyalty bonuses and campaign pools, taking the maximum payout for some findings to $172,000.
- OpenAI said it had increased its security bug bounty rewards to encourage independent researchers to find flaws in its software.
- The company said critical issues in ChatGPT, Codex and the API Platform could earn base awards of up to $30,000, while exceptional critical findings could reach $100,000 before bonuses.
- OpenAI said high-quality reports could receive a multiplier if they included a reliable proof of concept.
- The company introduced a five-tier loyalty scheme and separate bonus pools for short-term feature launches.
- OpenAI said it would apply the new reward ranges to already submitted reports that had not yet been awarded, and would pay the difference for bounties granted in the 30 days before the announcement if the new system would have paid more.
OpenAI said it had raised its bug bounty payouts and added bonuses for report quality, repeat participation and targeted campaigns. The company said the programme was meant to encourage responsible disclosure and sat alongside its Defense Factory work.
Under the updated structure, critical findings in ChatGPT, Codex and the API Platform could earn base awards of up to $30,000. OpenAI said exceptional critical findings could still qualify for base awards of up to $100,000.
With bonuses included, the company said total payouts could reach $172,000. It said strong submissions that included a reliable proof of concept could receive a higher multiple because they helped engineers isolate the bug, show exploitation conditions and assess impact.
OpenAI also added a five-level loyalty system that increased bonuses for longer-term participants. It said short-term campaigns would have dedicated pools for researchers testing newly released features.
The company said the new ranges would also apply to reports already submitted but not yet rewarded. For bounties paid within the previous 30 days, it said it would make up any difference if the revised rules would have produced a higher award.
Named in this story
Companies
- OpenAI
- raised its security bug bounty payouts and added bonus rules
Products and systems
- ChatGPT
- was named as a core product eligible for critical vulnerability bounties
- Codex
- was named as a core product eligible for critical vulnerability bounties
- API Platform
- was named as a core product eligible for critical vulnerability bounties
- Defense Factory
- was described as a place where OpenAI engineers use models to find and reproduce vulnerabilities and test fixes
How the source tells it
Straight news register with minimal emotive framing; the article mainly relayed OpenAI’s announced programme changes and its own explanation for them.
No emotive framing was found in the original.