OpenAI published new reward levels for its Security Bug Bounty program on November 2, 2026. The ceiling rises to $172,000, a critical vulnerability in a core product pays up to $30,000 before any bonus, and three multipliers now stack on the base award. This is a change to the price of a report, not to what counts as one.
What was actually released
No model, no product, no rate card. This is a rewrite of the payout structure of a bounty program that has existed since 2023, and it brings four moving parts.
The base raise comes first. OpenAI says it is more than quadrupling the midpoint of its reward ranges for medium, high and critical findings on average, and puts a critical bug in a core product, named as ChatGPT, Codex or the API Platform, at up to $30,000. An exceptional critical finding on those targets stays eligible for up to $100,000.
Then a quality multiplier, paid on top of the base award when a report carries a reliable proof of concept that isolates the bug, shows when it can be exploited and demonstrates its impact.
Then a loyalty program with five tiers. The page names three of them, Bronze, Gold and 31337, and leaves the thresholds to the program page. Then priority campaigns, which carry dedicated bonus pools for newly launched features and run for a short window. That is the only mechanism on the page with a clock attached.
The last clause matters more than it looks. Reports already submitted but not yet awarded get the new ranges, and bounties paid in the 30 days before the announcement are topped up. A researcher who filed in October and was paid $6,500 for a critical bug is owed the gap.
| Example finding | Historical award | New calculation | New payout |
|---|---|---|---|
| Medium, ChatGPT core: a read-only member can upload files to a Project without write permission | $750 | $2,000 x 1.15 quality x 1.05 Bronze loyalty | $2,415 |
| High, Prism non-core: an IDOR that reads a file uploaded to a user’s Project | $1,000 | $2,500 x 1.15 quality x 1.10 Gold loyalty | $3,162.50 |
| Critical, ChatGPT core: one-click account takeover | $6,500 | $30,000 x 1.15 quality x 1.30 priority campaign x 1.15 31337 loyalty | $51,577 |
| Exceptional, ChatGPT core: compromise of a security boundary, such as reading arbitrary users’ chat messages | $100,000 | $100,000 x 1.15 x 1.30 x 1.15 | $171,925 |
What the claim rests on
The four-times figure is an average over reward ranges, not over payments, and the page carries four illustrative examples to support it. Run those examples and the average holds at almost exactly 4.0: medium is 3.22 times its historical award, high is 3.16, critical is 7.9, and exceptional is 1.72. The headline average is carried by the critical case, not by the top of the range.
The $172,000 is the same story in a smaller way. OpenAI’s own worked example lands at $171,925, because the multipliers multiply: 1.15 times 1.30 times 1.15 is 1.71925. The rounded figure in the prose sits 75 dollars above what the table computes, and that ceiling requires a quality bonus, a live priority campaign and the top loyalty tier at the same time.
All scenarios and historical awards are illustrative.
That sentence sits under the table, and the announcement should be read with it in mind. Illustrative means the historical awards were picked to show the multipliers at work, not sampled from what the program paid. Nothing on the page is a distribution.
The movement is uneven. The $100,000 base for an exceptional finding grows least, medium and high roughly triple, and the critical example multiplies by nearly eight. The 2023 launch page put the whole program between $200 and $20,000.
What is not published
- No distribution of past payouts: no median, no count of reports, no total paid out in any year.
- No thresholds for the five loyalty tiers, so the time it takes to reach the top tier cannot be read.
- No base range for low severity findings, and no disclosure timeline.
On this page
What it changes for security researchers
The economics changed where most reports live. A medium finding in a core product goes from $750 to $2,415 with the two smallest bonuses, a 222% increase on a class filed constantly; the top of the range grew by 72%. For someone weighing an hour of testing against paid work, that matters more than the headline.
Behavior shifts in three directions. Proof now has a price, so a finding needs a reproduction that names when it can be exploited and what it breaks. Staying with one program has a price, since the loyalty tier feeds every future payout. And newly launched features are the subsidized target: a priority campaign ties the bonus to a date, not to a researcher’s history.
The retroactive clause is worth checking by hand. Anyone who filed before November 2 and has not been paid falls under the new ranges, and anyone paid inside the previous 30 days should claim the difference.
The Neural Minute take
The number to remember is $2,415, not $172,000. One is what a competent researcher will see for a real bug in a heavily used product; the other needs a live campaign and a top-tier history. Announcements lead with the ceiling because that is what gets repeated, and our reading of the table is that the base award, the part every accepted report receives, is where the change lands.
What this says to a buyer of these tools is narrower than it looks. OpenAI writes that the goal is to reach vulnerabilities “that our testing may have missed”. That is a statement about coverage, not about a breach, and nothing here says the products became less safe this week. It does say that a company shipping features quickly has decided outside eyes on its newest surface are worth several times what it paid last month.
The priority campaign mechanism is the part we would watch. A bonus pool attached to newly launched features is a map of where the vendor expects gaps, published by the vendor, and it will point at the surfaces our readers adopt first. When a campaign opens on a feature you already run in production, the rational move is to slow the rollout, not to speed it up.
The direction of travel across the labs is the same. Google put Gemini 4 Carbon in the hands of cyber defenders before general release, and OpenAI now pays multiples of last month’s rate for the same class of finding.
Our reservation is the one the page invites. Four illustrative examples and a ceiling do not describe a program, and the figure that will say whether this worked is the distribution of real payouts six months from now, which no vendor here publishes. If the medium case is the one that moves, the program will show it in volume, and volume is what the announcement leaves out.
Sources
- Rewarding defenders with bigger bug bounties, OpenAI, published November 2, 2026: the announcement
- The payout examples table on the same page, read on November 3, 2026, is the source for every award quoted here and for the illustrative footnote
- Announcing OpenAI’s Bug Bounty Program, OpenAI, 2023, for the $200 to $20,000 range the program opened with: the launch page
- The multiples here, 3.22, 3.16, 7.9 and 1.72, are our division of the new payout by the historical award; 1.71925 is our multiplication of the three bonuses