π November 3, 2026 β’ the-decoder.com
What happened
OpenAI says it has more than quadrupled the midpoint of the reward ranges it pays security researchers through its bug bounty program, and the maximum single payout now stands at roughly $172,000 with bonuses. The change was reported by the-decoder.com on November 3 and is paired with OpenAI's own announcement. Bug bounty programs pay independent researchers for responsibly disclosed vulnerabilities, with awards scaled to severity and quality, and OpenAI's covers its models, applications and infrastructure.
The numbers
Per OpenAI, the midpoint of reward ranges for medium, high and critical findings has grown more than fourfold on average. The top award reaches $172,000 with quality, loyalty and campaign bonuses for exceptional critical findings, up from a $100,000 base. New reward multipliers add extra weight to three things: the quality of an individual report, researcher loyalty over time, and priority campaigns with dedicated bonus pools for newly launched features. The multiplier structure means two reports of equal severity can now earn different amounts based on completeness and track record.
How it works
The payout update runs alongside OpenAI's next internal security sprint, run together with Cathedral Systems and relying on AI tooling to accelerate testing and triage. OpenAI pairs the program with its internal Defense Factory work, where engineers use the company's own models to find weaknesses, reproduce them and test fixes.
IMPACT
The economics are the story. OpenAI is treating external researchers as core defense infrastructure, not as an occasional source of tips: more than quadrupling the reward ranges signals that the cost of a serious vulnerability reaching production far exceeds the cost of paying for its discovery. For researchers, multipliers for quality and loyalty make sustained work on one platform measurably more lucrative than one-off submissions, which should deepen the pool of specialists focused on AI-specific vulnerability classes. Competing AI labs now face a benchmark for what security spending looks like in this market.
Sources: the-decoder.com, openai.com, bugcrowd.com
Continue the conversation: https://t.me/AIAutomationArchitecture Β· Bluesky
Top comments (0)