OpenAI raises its Security Bug Bounty rewards and adds bonuses for report quality and loyalty

OpenAI says it is raising rewards in its Security Bug Bounty program, "more than quadrupling" the midpoint of the reward ranges for medium, high and critical findings on average.

• Core products: a critical vulnerability in ChatGPT, Codex or the API Platform now earns up to $30,000. Exceptional critical findings on those targets stay eligible for up to $100,000, and up to $172,000 with bonuses.
• Report quality: high-quality reports, such as those with a reliable proof of concept, can earn a bonus multiplier on the base bounty.
• Loyalty: a new five-tier program gives scaling bonuses to researchers who report repeatedly.
• Priority campaigns: short-term bonus pools for newly launched features.
• Retroactive payments: reports that have not yet been rewarded get the new ranges, and bounties awarded in the 30 days before the announcement are topped up where the new ranges pay more.

OpenAI's example: a one-click account takeover on ChatGPT, historically $6,500, would now come to $51,577 with the quality, priority-campaign and top loyalty bonuses. OpenAI's security team will be at the PROMPT2PWN event in Oakland on November 20–21.

The same day, OpenAI described a new internal security sprint with the security firm Cathedral Systems, whose researchers will use OpenAI's models alongside its teams to challenge its defenses, and said the bounty changes are part of the same effort. OpenAI also says it will keep expanding access to its models for trusted defenders.