OpenAI raises bug bounty payouts, adds new researcher bonuses

OpenAI is raising the rewards it pays through its Security Bug Bounty program and adding three new types of bonuses for independent security researchers, the company said in a post titled “Rewarding defenders with bigger bug bounties.”

A bug bounty program pays outside researchers for privately reporting security flaws instead of selling or publishing them. OpenAI’s update adds a report quality bonus, paid when a researcher’s write-up is unusually clear or thorough; a loyalty bonus, aimed at researchers who keep submitting reports to the company over time; and a priority campaign bonus, tied to specific bug-hunting efforts OpenAI runs on systems it wants checked first.

The source material does not specify the new dollar amounts, how much each bonus adds on top of a standard payout, or which systems the priority campaigns will target. OpenAI also did not give a start date for the changes or say whether they apply retroactively to reports already in its pipeline.

Bug bounty programs are a standard part of how large technology companies find security flaws before attackers do. By paying researchers directly, a company creates an incentive to report a bug privately rather than exploit it or sell knowledge of it elsewhere. OpenAI’s decision to add loyalty and quality incentives suggests the company wants to encourage repeat engagement from a trusted pool of researchers, not just one-off submissions.

The move comes as OpenAI’s products, including its AI models and the infrastructure that runs them, face growing scrutiny over security. Bigger rewards and new bonus categories give researchers more reason to spend time on the kind of deep, careful testing that uncovers harder-to-find vulnerabilities, rather than chasing the fastest payout.

OpenAI frames the changes as a way to reshape disclosure incentives, meaning the rules that determine when and how a researcher chooses to tell a company about a flaw. A higher base reward makes reporting more attractive compared with other options a researcher might have for a discovered bug. The quality bonus specifically rewards researchers for reports that are easier for OpenAI’s security team to act on quickly, which can shorten the time a vulnerability sits unpatched.

The loyalty bonus marks a shift toward treating bug bounty participation as an ongoing relationship rather than a series of unconnected transactions. Companies that run these programs often find that a small group of researchers accounts for a large share of valid reports, so rewarding repeat contributors can help retain that core group.

OpenAI did not detail how researchers can qualify for the priority campaign bonus or how the company selects which systems get prioritized treatment. It is also unclear whether the new bonus structure will be published in full detail or applied case by case by OpenAI’s security team.