OpenAI raises bug bounties to $172,000 at the ceiling, and $30,000 for core criticals

The headline: critical bugs in core products now pay up to $30,000, with a ceiling near $172,000

On November 2, 2026, OpenAI raised the rewards in its Security Bug Bounty program: the midpoints of the reward ranges for medium, high, and critical findings have more than quadrupled on average. A critical vulnerability in a core product, ChatGPT, Codex, or the API Platform, will now earn up to $30,000. Exceptional critical findings on those targets remain eligible for up to $100,000 before bonuses, and up to about $172,000 with bonuses applied. On the same day, OpenAI announced a companion move: its next internal security sprint will bring in researchers from the outside firm Cathedral Systems, who will use OpenAI's models alongside OpenAI's teams to challenge its defenses.

One number needs clarifying before anything else: $172,000 is not the new price of a critical bug. It is a ceiling, and reaching it requires four things at once, an exceptional finding, a high-quality report, a priority campaign, and the top loyalty tier. Most reports will never get there. The new normal for a critical bug in a core product is the $30,000 cap. Keeping that distinction in mind is the key to judging what this change actually does.

Four changes, stated plainly

First, base reward ranges are up across the board. OpenAI says the midpoints for medium, high, and critical findings have more than quadrupled on average. The anchor it gives is the $30,000 cap for critical bugs in core products. Note the qualifier "core products": non-core assets pay less. In OpenAI's own examples, a high-severity IDOR in Prism, a non-core asset, carries a base reward of $2,500, nowhere near the core-product $30,000. Before you start testing, confirming which tier your target sits in matters more than calculating the reward.

Second, a report quality bonus. Reports with a reliable proof of concept that isolates the bug, shows when it can be exploited, and demonstrates its impact are eligible for a quality multiplier, 1.15 in OpenAI's examples. The signal here is unmistakable: OpenAI is buying not just the discovery but the reproducible, fixable discovery. A report with only screenshots and a guess and a report an engineer can reproduce step by step are now worth 15 percent apart.

Third, a five-tier loyalty program. OpenAI has introduced scaling bonuses for researchers who keep partnering with it. The tiers appearing in its examples are Bronze at 1.05, Gold at 1.10, and the top tier, 31337, at 1.15. This prices the relationship itself: the same vulnerability submitted by a first-time reporter and by a long-term partner is worth different amounts. For independent researchers, that turns a long-term relationship with a vendor into something with compounding value.

Fourth, priority campaign multipliers. For newly launched features, OpenAI will run short-term priority campaigns with dedicated bonus pools, at 1.30 in the examples. This is the most time-sensitive of the four: vulnerabilities in a new feature's launch window face less competition and carry a 30 percent bonus. Watching a vendor's launch calendar is now part of the job, not an optional extra.

The official worked examples: how the stacking actually works

OpenAI published four worked examples, all labeled illustrative, including the historical awards. A medium finding, a read-only member uploading files to a ChatGPT Project without write permission, historically paid $750; the new calculation is $2,000 times 1.15 for quality times 1.05 for Bronze loyalty, giving $2,415. A high finding, an IDOR in Prism letting an attacker read a file another user uploaded to a Project, historically paid $1,000; the new calculation is $2,500 times 1.15 times 1.10 for Gold loyalty, giving $3,162.50.

The critical example is the most instructive. A one-click account takeover in ChatGPT, a core asset, historically paid $6,500. The new calculation is $30,000 times 1.15 for quality times 1.30 for a priority campaign times 1.15 for 31337 loyalty, giving $51,577. The exceptional example, a significant compromise of a security boundary such as the ability to view arbitrary ChatGPT users' chat messages, keeps its $100,000 base and stacks the same way: $100,000 times 1.15 times 1.30 times 1.15 equals $171,925, which rounds to the advertised $172,000. Note that the multipliers compound: 1.15 times 1.30 times 1.15 is about 1.72, not a simple addition of 15 and 30 percent, and that compounding is exactly where the headline ceiling comes from.

The table also carries a counterintuitive lesson: the same vulnerability has different prices in different hands. A Bronze researcher and a 31337 researcher submitting the identical critical bug are about 10 percent apart; submitting inside or outside a priority campaign is a 30 percent difference. Strategy is no longer just "which bug to find" but "when to submit it, at what quality, and under which standing."

Retroactive payments: reports already in flight get the new rates

The update includes a researcher-friendly retroactivity clause: reports already submitted but not yet awarded will be paid under the new ranges, and bounties awarded in the 30 days before the announcement will be topped up if the finding would have earned more under the new ranges, counting base award plus loyalty awards. That removes the "should I have waited" dilemma, and it removes the incentive to sit on a report while waiting for better terms, which helps nobody, least of all users.

From the vendor's side, topping up is cheap money in exchange for trust. The researcher never has to guess whether submitting now or later is the better deal, because the rule itself guarantees they will not lose out. That is a design lesson worth stealing for anyone running a bounty program, a beta program, or any feedback channel: uncertainty in the rules is itself a cost, and writing the answer down is cheaper than explaining it case by case.

The companion move: a security sprint with Cathedral Systems

The same-day companion announcement is that OpenAI is preparing its next internal security sprint, with Cathedral Systems researchers using OpenAI's models alongside OpenAI's teams to challenge its defenses. OpenAI's own phrasing is that Cathedral brings "differentiated expertise and approaches." According to multiple secondary reports, no start date, duration, or target list has been disclosed for this sprint, so for now it should be read as a planned collaboration, not a completed round of testing.

Taken together, the two announcements form a complete logic: higher bounties to attract outside researchers, and an internal sprint with an outside team and its own models to attack its own systems. Secondary reporting of the companion post says the previous internal sprint mobilized roughly a quarter of OpenAI's product engineers, with Codex used to investigate findings, reproduce them in isolated environments, and prepare patches for review, alongside a restated $1 billion commitment in subsidized access for frontline defenders over six months. Those are vendor claims as reported, not independently measured results, but the direction is clear: when attackers can use powerful models too, defenders have to point the same capability at their own code first.

One caution on background: Cathedral has recently been the subject of reporting about its conduct in another AI lab's bounty program. OpenAI's announcement does not mention that background, and this article does not treat it as a fact of the OpenAI announcement or draw conclusions about the collaboration from it. Readers who care should check the original reporting rather than inferring anything from the bounty post.

For independent researchers: do not make $172,000 your target

Treating $172,000 as the goal is a good way to waste weeks chasing an exceptional finding that may not exist. A more realistic target is the product of three controllable factors: the right asset, core products first; the right timing, the priority-campaign window after a new feature launch; and a report written to be reproducible. Each of the three carries a defined bonus, and none of them depends on luck.

In practice that means three habits. First, prioritize new features in core products; the first two weeks after launch are typically the best window on both reward and competition. Second, standardize your report template: isolation steps, exploitability conditions, impact argument, reproduction environment. The quality multiplier is, in effect, payment for that template. Third, treat the relationship with OpenAI as a long-term one; the loyalty tiers compound on your third and fifth submissions, not your first.

One practical note: OpenAI's security team will be at PROMPT2PWN in Oakland on November 20 and 21, where researchers can test targets in person. If you are nearby, an in-person conversation about scope is usually faster than an email thread, and scope questions settled face to face are scope questions that do not come back as rejected reports.

What this means for vibe developers, even if you never submit a bounty

This story has direct value for vibe developers who never submit a vulnerability in their lives. Strip away the numbers, and OpenAI's redesign solves three operating problems with pricing: how to make reports reproducible (the quality multiplier), how to keep good researchers around (the loyalty tiers), and how to get new features tested first (the priority campaigns). Every product that takes outside security feedback, runs a beta program, or manages a tester community faces the same three problems.

One transferable pattern: if you accept security feedback on your own project, split the reward into base plus quality plus ongoing partnership, instead of a single flat number. The base prices the discovery, the quality bonus prices the usability of the report, and the partnership bonus prices the relationship. Once split, researchers know where to invest their effort, and you stop renegotiating "what is this report worth" from scratch every time. Note the boundary here: this site has already published a hands-on guide to running your own bounty program (vibe-project-bug-bounty-guide), which covers building a program from zero; this article covers one vendor's new pricing, and the two are different topics.

Finally, a basic judgment. When an AI lab raises its bounty ceiling from $100,000 to about $172,000, what it is really buying is a position in researchers' attention ranking: it wants the best researchers to look at its products before someone else's. That is a reminder for every team that depends on outside security feedback: bounty rates are not a cost line, they are a bid for attention, and your rate decides where you sit on a researcher's to-do list.

Checking the numbers: why $171,925, not $172,000

Careful readers will notice the headline figure is "up to $172,000" while the worked example computes to $171,925. There is no contradiction: $172,000 is the rounded public figure, and $171,925 is the exact product of $100,000 times 1.15 times 1.30 times 1.15. Likewise the critical example's $51,577 is $30,000 times 1.15 times 1.30 times 1.15, rounded from $51,577.50. When quoting these figures, give both the exact example and the rounded headline, and do not present the rounded figure as a precise promise.

One more figure deserves its own check. OpenAI says the midpoints "more than quadrupled on average," which is an average across tiers, not a uniform fourfold increase. From the examples, a medium finding goes from a $750 historical award to a $2,000 base, about 2.7 times; a high finding from $1,000 to $2,500, about 2.5 times; a critical finding from $6,500 to $30,000, about 4.6 times. The increase is tilted toward the most severe tier, which is exactly what bounty design should do: the vendor most wants to buy the highest-impact findings.

One thing to confirm before you test anything: scope lives on the program page

The announcement itself speaks of "vulnerabilities in OpenAI software" and does not enumerate an inclusion and exclusion list in its body. In practice, scope, asset tiers, report format, and disclosure rules live on the Bugcrowd program page, and that page governs. Do not start testing on the strength of a news article alone: read the program page first, confirm the target is in scope, confirm the testing method is permitted, and confirm the disclosure process, then begin.

The reminder sounds redundant, but it is the most common way newcomers lose a report: testing an out-of-scope asset, using a disallowed technique, or disclosing before a fix is confirmed, any of which can void a report or cost a future relationship. Ten minutes reading the rules page beats ten emails appealing a rejection. The fact that OpenAI wrote its reward examples this transparently is itself a sign it would rather researchers spend their energy finding bugs than guessing at rules.